Security Advisory

This Week's Top 5: An Exploited Outlook Flaw on Patch Tuesday, a Chrome and Edge Zero-Day, and Barracuda Gateways Under Attack

Published November 15, 2026 · Cyber One Solutions

Microsoft's November 10 security release included one flaw already being exploited, in Outlook. Google and Microsoft both shipped fixes for a Chromium flaw with an exploit in the wild, Barracuda confirmed attacks on its email gateways, SonicWall revised last week's VPN advisory with a workaround and a newer firmware build, and CISA added a Check Point firewall flaw to its exploited list. Here are the five verified developments for small and mid-size businesses this week, ranked by relevance, exploitation evidence, and urgency.

This brief covers verified security and compliance developments from Sunday, November 8 through Saturday, November 14, 2026, with a research cutoff of Sunday, November 15, 2026 at 5:15 a.m. Central. It is the edition for the regular Sunday, November 15 slot. The week was dominated by vendor patches for flaws that were already being exploited when the fixes arrived, and CISA added 12 entries to its Known Exploited Vulnerabilities (KEV) catalog between November 9 and November 13. We found no new HIPAA, FTC Safeguards Rule, or CMMC development inside this window that we could confirm from a regulator's own publication, so this edition is entirely about patching and exposure.

Executive Summary and Priorities

Five verified developments met our bar for inclusion this week:

A Microsoft Outlook flaw, CVE-2026-124194, that Microsoft marked as already exploited when it shipped the fix in its November 10 monthly security release.
A Chromium browser flaw, CVE-2026-125350, with an exploit in the wild, fixed in Google Chrome on November 9 and in Microsoft Edge on desktop in a release Microsoft dates the same day.
Two chained flaws in Barracuda appliances, CVE-2026-116606 and CVE-2026-111560, where Barracuda now reports exploitation against a small number of organizations.
An update to last week's lead item: SonicWall revised its advisory for the SonicOS SSL VPN bypass, CVE-2026-19868, to add a workaround, and published a separate advisory with a newer firmware build.
A local privilege escalation flaw in Check Point's Gaia operating system, CVE-2026-123039, that CISA added to its KEV catalog on November 13.

We covered the first three in detail in an advisory on November 11, updated November 14: Exploited Flaws in Outlook, Chrome, and Barracuda Email Gateways. This brief ranks them against the rest of the week and adds what has changed since.

How We Ranked This Week's Developments

We ranked these five by how many of the businesses we serve run the affected technology, the strength and source of the exploitation evidence, how much an attacker needs before the flaw is useful, and how close the federal remediation date is. Outlook ranks first because the Outlook desktop app is so widely used in business, Microsoft itself reports exploitation, and the fix depends on Office updates actually reaching every device. The browser flaw ranks second for the same reach, with the difference that Chrome and Edge update themselves and mostly need a restart. Barracuda ranks third: the exploitation is confirmed by the vendor and the federal date has already passed, but only businesses with one of the named appliances are affected, and the attack needs the administrative interface to be reachable. SonicWall ranks fourth because it is an update to an item we already ranked first last week, not a new flaw. Check Point ranks fifth because an attacker must already be logged in to the device as a local user. These rankings are editorial judgments, not a measured risk score.

1. Microsoft's November Security Release Includes an Outlook Flaw Already Under Attack

Microsoft published its monthly security release on November 10, 2026. In Microsoft's own release data, checked at its November 15 revision, one vulnerability in the release is marked as exploited and none are marked as publicly disclosed before the fix. The exploited one is CVE-2026-124194, a Microsoft Outlook spoofing vulnerability that Microsoft rates Moderate with a CVSS score of 6.5. CISA added it to the KEV catalog the same day, with a remediation due date of November 24.

Microsoft's advisory says an attacker "could send a specially crafted message file and convince a user to open it in an affected version of Microsoft Outlook," and that opening the file could cause Outlook to connect to an attacker-controlled location "without displaying the usual external-content warning." Microsoft states that the flaw "discloses a user's NTLMv2 hash to the attacker who could use this to authenticate as the user." An NTLMv2 hash is a scrambled form of a Windows sign-in credential, not the password itself, but it can be enough for an attacker to sign in as that person. Microsoft also states that the Preview Pane is not an attack vector: someone has to open the file.

Who is affected: businesses running the Outlook desktop app from Microsoft 365 Apps for Enterprise, Office LTSC 2021, or Office LTSC 2024, in 32-bit or 64-bit editions, until the November 10 update is installed. Microsoft's advisory does not list any other Outlook product as affected.

The moderate rating reflects that a person has to act, not that the flaw is harmless. The practical risk for a small business is a credential captured from one employee who opened an unexpected attachment. This week's action is to confirm that the November 10 Office update has reached every Windows computer, including laptops that are rarely in the office, and to remind staff not to open message files or Office attachments they were not expecting.

2. A Chromium Flaw With an Exploit in the Wild, Now Fixed in Both Chrome and Edge

Google's Stable Channel Update for Desktop on November 9, 2026 moved Chrome to 157.0.8103.50/.51 for Windows and Mac and 157.0.8103.50 for Linux, and states: "Google is aware that an exploit for CVE-2026-125350 exists in the wild." The CVE record describes a use after free in XML that allowed a remote attacker to execute code inside the browser's sandbox through a crafted web page. CISA added it to the KEV catalog on November 10, with a due date of November 24, and notes that it can affect other Chromium-based browsers, including Microsoft Edge and Opera.

What changed during the week is Edge. When we first reported this on November 11, Microsoft's security release notes said a fix was still being worked on. Those notes now list Microsoft Edge Stable version 157.0.4341.46, in an entry dated November 9, 2026, as containing the fix, and Microsoft revised its update guide entry for the CVE on November 13 to add Edge. Google also shipped a further Chrome desktop update on November 11, version 157.0.8103.78/.79, with 83 security fixes and no statement of exploitation for any of them.

Who is affected: any computer running Chrome older than 157.0.8103.50 or desktop Edge older than 157.0.4341.46. A browser that has downloaded the update but has not been restarted is still running the old code.

Both browsers update themselves, so the usual failure is not a missing update but a browser left open for weeks. Ask staff to close and reopen their browsers, and if your devices are managed, ask for a report of browser versions rather than assuming.

3. Barracuda Confirms Exploitation of Two Chained Appliance Flaws

Barracuda's advisory, first published November 2, 2026, covers two flaws. CVE-2026-116606 is a pre-authentication authorization bypass in the Email Security Gateway (ESG), scored 9.3. CVE-2026-111560 is a command injection flaw, scored 8.6, in the ESG and five other products: Load Balancer Application Delivery Controller, Message Archiver, WAF Control Center, Web Application Firewall, and Web Security Gateway. Barracuda says that used together they "could allow an attacker to bypass authorization controls and obtain root access to the device." On November 9, Barracuda updated the advisory to say it has "identified exploitation activity affecting a small number of organizations." CISA added both flaws to the KEV catalog on November 10 with a due date of November 13, which has now passed. Barracuda's advisory showed no further update when we checked on November 15.

Who is affected: businesses that run one of the six named Barracuda appliances and have not received the patch. Barracuda notes that exploitation requires the administrative interface to be reachable by the attacker, and that organizations whose administrative interfaces are not publicly accessible from the internet "are less exposed to this attack path."

An email gateway sees every message a business sends and receives, so a compromised one is a serious matter for any company that handles customer financial or health information. Barracuda says patches are released for every affected product and that a device several firmware versions behind may need more than one update. If you have one of these appliances, confirm the patch is applied and that the administrative interface is reachable only from trusted internal networks. If it was exposed to the internet before patching, have the device reviewed instead of assuming the patch settles it.

4. Update: SonicWall Adds a Workaround for Last Week's VPN Bypass and Publishes a Newer Firmware Build

Last week's brief ranked CVE-2026-19868, a SAML authentication bypass in SonicWall's SonicOS SSL VPN, first, and reported that no workaround was available. That is no longer accurate. SonicWall revised advisory SNWLID-2026-0014 on November 9, 2026, and the revision history states that the workaround section was updated for this flaw. The workaround reads: "If SAML authentication is in use and upgrading the firmware is not possible, disable or delete any active LDAP, RADIUS, and TACACS+ authentication server configured on the firewall." Those servers may be in use for other logins on the firewall, so treat that as a decision for whoever administers the device, and as a stopgap. SonicWall still urges customers "to upgrade to the latest release as soon as possible."

Last week we could not read SonicWall's advisory directly and attributed the version numbers to it secondhand. We have now read them in the advisory itself: SonicOS 7.3.3-7015 and older on Gen 7 firewalls and 8.2.2-8015 and older on Gen 8 firewalls are affected, with fixes in 7.3.4-7013 and higher and 8.2.3-8015 and higher. SonicWall also states that the flaw only affects the SSL VPN service if SAML is enabled for SSL VPN logins. CISA's due date for this flaw is November 20.

There is a second reason to look at firmware again. On November 10, SonicWall published an informational advisory, SNWLID-2026-0021, about firewalls with Client DPI-SSL enabled that continued to trust certificate chains issued by compromised eMudhra intermediate certificate authorities. Client DPI-SSL is the feature that lets the firewall inspect encrypted web traffic. The fixed versions for that issue are 7.3.4-7015 and higher on Gen 7 and 8.2.3-8015 and higher on Gen 8. For a Gen 7 firewall, that means a device upgraded to 7.3.4-7013 for the VPN bypass is still in the affected range for this second advisory if Client DPI-SSL is turned on.

Who is affected: businesses with SonicWall Gen 7 or Gen 8 firewalls. The VPN bypass applies only where SAML is used for SSL VPN logins, and the certificate trust issue applies only where Client DPI-SSL is enabled.

5. CISA Adds a Check Point Gaia Privilege Escalation Flaw to Its Exploited List

CISA added CVE-2026-123039 to the KEV catalog on November 13, 2026, with a due date of November 16. Check Point published the CVE on November 12 and scores it 7.8 (High). According to Check Point's CVE record, the Gaia OS DynamicCLI daemon runs as root and listens on a local socket without authenticating the processes that connect to it, so "an authenticated local user can send a command to the socket and have it executed as root." The record lists Quantum Security Gateway and Quantum Security Management as affected on R81.20 with Jumbo Hotfix Take 173 or below, R82 with Take 130 or below, R82.10 with Take 50 or below, and R82.20 with Take 10 or below. Check Point's advisory is sk1000362.

Who is affected: businesses running Check Point Quantum gateways or management servers at or below those hotfix levels. An attacker cannot use this flaw from the internet on its own; it requires an existing local login on the device. That is why it ranks last this week, and also why it matters: it is the kind of flaw used to turn a limited foothold on a firewall into full control.

If your business has a Check Point firewall, ask whoever manages it which Jumbo Hotfix Take it is running, apply the update Check Point's advisory specifies, and review who has shell or administrator accounts on the device.

Also Added to the KEV Catalog This Week

CISA added the OpenSSH password-authentication bypass we covered last week, CVE-2026-123158, to the KEV catalog on November 9 with a due date of November 12. That confirms the exploitation we described, and the scope has not changed: it affects sshd on Linux systems built with musl libc without PAM, such as Alpine Linux and containers built on it.

CISA also added CVE-2026-116779 on November 9, a flaw in FreeSWITCH, the open-source telephony software that some phone systems are built on. The CVE record, published through GitHub, says a peer whose SIP message is accepted can run FreeSWITCH commands with the daemon's privileges, that "exploitation has been observed in the wild," and that the issue is fixed in version 1.11.3. Most of the businesses we serve use a hosted phone service and do not run FreeSWITCH themselves. If your business runs its own phone system on a server, ask whoever supports it whether it is built on FreeSWITCH and which version it runs.

The other entries CISA added this week, in Cisco BroadWorks, IBM Aspera Faspex, GPUStack, Openwave Webtop Media Transcoder, and UnrealIRCd, are not products a typical small business runs itself.

Worth Planning For: Fortinet's November Advisories

Fortinet published a large set of advisories on November 10, 2026. Three stand out for small businesses: FG-IR-26-199 (CVSS 9.8) and FG-IR-26-216 (CVSS 9.4), each describing a way for an unauthenticated attacker to execute code or commands on FortiMail, and FG-IR-26-269 (CVSS 7.4), an authentication bypass in the SSH service of FortiOS, the software on FortiGate firewalls. Each of those three advisories lists "Known Exploited: No," and none of them appears in CISA's catalog as of our cutoff. That is why they are not ranked above. Severity is not the same as exploitation, but internet-facing firewalls and mail gateways are frequent targets, so the fixed versions in those advisories belong in this month's maintenance, not next quarter's.

Do Now

Confirm the November 10 Office update is installed on every Windows computer, and remind staff not to open unexpected message files or Office attachments.
Have everyone close and reopen Chrome and Edge, then confirm Chrome is at 157.0.8103.50 or later and Edge is at 157.0.4341.46 or later.
If you have a Barracuda appliance named above, confirm the patch from Barracuda's advisory is applied and the administrative interface is not reachable from the internet.
If you have a SonicWall Gen 7 or Gen 8 firewall, confirm its firmware against both SonicWall advisories, not only last week's.
If you have a Check Point firewall, confirm its Jumbo Hotfix Take against sk1000362.

Plan Next

Schedule FortiMail and FortiGate updates against Fortinet's November 10 advisories if you run either product.
Ask your IT provider how they confirm that an update was installed and is running, not just offered, on laptops that are often away from the office.
Make a list of every appliance with an administrative web interface, such as firewalls, email gateways, and phone systems, and confirm none of those interfaces is reachable from the internet.

Watch List

Whether Barracuda reports more about the exploitation it has observed or publishes signs of compromise for customers to check.
Whether Microsoft changes the exploitation status of any other vulnerability in its November release.
Whether any of Fortinet's November 10 advisories is updated to report exploitation or is added to CISA's catalog.
Whether SonicWall or CISA report confirmed intrusions tied to CVE-2026-19868 as the November 20 date approaches.

The Bottom Line

Every ranked item this week has a fix available, and in every case the open question for a business is whether that fix is actually installed and running on its own devices. CISA's due dates bind U.S. federal civilian agencies, not private businesses, but they are a reasonable benchmark for how quickly these should be handled. This brief is general security awareness, not a HIPAA, FTC Safeguards, or cyber-insurance compliance service. Cyber One Solutions keeps Office, Outlook, and the rest of a company's Microsoft 365 environment updated and supported through our Microsoft 365 support service, and tracks vendor advisories for firewalls, VPN gateways, and email security appliances against the systems a client actually runs through managed cybersecurity. If you are not sure where your business stands on any of this week's items, our free cybersecurity risk score self-assessment is a quick way to find out.