12 Exploited Vulnerabilities Across Enterprise Infrastructure, Security Gateways and Applications
The CISA KEV Catalog continues to be an important source of exploitation intelligence. This week’s additions cover a broad range of enterprise technologies, from AI infrastructure and remote administration to email security, collaboration and network security management.
What deserves attention is not just the number of vulnerabilities, but the way some of these weaknesses can affect privileged access and critical infrastructure.
Let’s examine the additions.
1. GPUStack – CVE-2026-102895
Added: November 9 | CISA due date: November 12
GPUStack is an open-source platform for deploying and managing AI models.
The vulnerability involves improper authentication. An attacker could exploit trusted loopback handling and reverse-proxy trust mechanisms to obtain administrative access without authentication.
As organisations expand their private AI infrastructure, GPUStack and similar model-management platforms must become part of the enterprise asset inventory.
Action: Identify exposed GPUStack deployments and upgrade to version 2.2.0 or later. Validate reverse-proxy and trusted-header configurations.
2. SignalWire FreeSWITCH – CVE-2026-116779
Added: November 9 | CISA due date: November 12
FreeSWITCH is an open-source communications platform used for voice and messaging services.
The vulnerability allows code injection through SIP MESSAGE processing. Specifically, an inbound SIP MESSAGE can select the API chat protocol and invoke FreeSWITCH API commands.
This highlights an often-overlooked attack surface: enterprise voice infrastructure.
Action: Upgrade to FreeSWITCH 1.11.3 or later, review SIP access controls and investigate suspicious API command execution.
3. OpenBSD OpenSSH – CVE-2026-123158
Added: November 9 | CISA due date: November 12
OpenSSH is a fundamental component of secure remote administration.
This vulnerability involves an authentication bypass under a specific configuration: OpenSSH running on Linux with musl libc and without PAM.
This is not a blanket vulnerability affecting every OpenSSH deployment. The operating system and authentication configuration matter.
Action: Identify affected Linux distributions and configurations, and apply the relevant OpenSSH or vendor security update.
4. IBM Aspera Faspex – CVE-2026-123218
Added: November 9 | CISA due date: November 12
IBM Aspera Faspex supports managed file exchange and large-file transfers.
CVE-2026-123218 involves incorrect authorization. The weakness can allow actions to be performed without the appropriate authorization checks.
File-transfer platforms often handle sensitive business information and exchange data across organisational boundaries.
Action: Validate affected Faspex deployments, apply IBM’s security updates and review access permissions.
5. Cisco BroadWorks – CVE-2026-20320
Added: November 10 | CISA due date: November 24
Cisco BroadWorks is an enterprise communications platform.
The vulnerability exists in the Open Client Interface XML parser and involves improper restriction of XML External Entity (XXE) references.
An unauthenticated remote attacker could potentially exploit the weakness to read sensitive configuration information.
XML parsing vulnerabilities remain relevant wherever applications process externally supplied XML data.
Action: Apply Cisco’s recommended security updates and review exposed BroadWorks components.
6. Barracuda Networks Multiple Products – CVE-2026-111560
Added: November 10 | CISA due date: November 13
This vulnerability involves OS command injection affecting multiple Barracuda product families.
The weakness is associated with insufficient validation of a timezone configuration value, potentially allowing an attacker to execute operating system commands.
The affected product scope includes several Barracuda security and network appliances.
Security appliances are particularly sensitive because they frequently operate with elevated privileges and sit within critical network paths.
Action: Identify affected Barracuda appliances, apply the relevant product-specific security updates and investigate suspicious configuration changes.
7. Openwave Webtop Media Transcoder – CVE-2026-111793
Added: November 10 | CISA due date: November 24
The Openwave Webtop Media Transcoder vulnerability concerns incorrect resource transfer between security spheres.
The weakness relates to administrator-defined file-type restrictions not being properly enforced during document conversion.
An attacker could potentially submit files that should have been rejected under the configured restrictions.
Action: Validate affected installations, review file-conversion activity and apply the vendor’s recommended remediation.
8. Barracuda Email Security Gateway – CVE-2026-116606
Added: November 10 | CISA due date: November 13
This vulnerability involves authentication bypass in Barracuda Email Security Gateway.
The issue affects the configuration restoration functionality and could allow an attacker to bypass normal authentication controls through an alternate pathway.
This becomes more concerning when considered alongside CVE-2026-111560, which introduces command injection across Barracuda products.
The two vulnerabilities should be assessed together when determining exposure.
Action: Apply Barracuda’s prescribed security updates, restrict administrative access and investigate suspicious configuration restoration activity.
9. Microsoft Office Outlook – CVE-2026-124194
Added: November 10 | CISA due date: November 24
Microsoft Outlook remains one of the most widely deployed enterprise communication applications.
This vulnerability is classified as missing user interaction for a potentially unsafe action and is associated with a spoofing security impact.
The absence of expected user interaction requirements makes this particularly relevant to email security and endpoint protection.
Action: Apply Microsoft’s relevant security updates and validate patch compliance across supported Office and Microsoft 365 installations.
10. Google Chromium – CVE-2026-125350
Added: November 10 | CISA due date: November 24
The vulnerability affects Chromium through a use-after-free memory management issue in its XML functionality.
Successful exploitation could allow a remote attacker to execute arbitrary code within the browser’s sandbox through a specially crafted HTML page.
Chromium forms the foundation of several widely used browsers, making enterprise browser patch management important.
Action: Update Google Chrome to version 157.0.8103.50 or later and validate equivalent security updates for other Chromium-based browsers.
11. UnrealIRCd – CVE-2026-114713
November 13 addition
CISA due date: November 16
UnrealIRCd is an open-source Internet Relay Chat server.
The vulnerability involves improper neutralisation of delimiters. A user on an IRC network with two or more linked servers could inject server-to-server commands that execute with server authority.
The issue highlights the security implications of trust relationships between interconnected IRC servers.
Action: Upgrade to UnrealIRCd 6.2.7.1 or later, review linked-server configurations and investigate suspicious server-to-server commands.
12. Check Point Multiple Products – CVE-2026-123039
November 13 addition
CISA due date: November 16
The final addition of the week affects Check Point security infrastructure, including Quantum Security Gateway and Security Management products.
The vulnerability involves incorrect permission assignment for critical resources.
The underlying issue concerns the Gaia OS DynamicCLI daemon running with root privileges and exposing a world-writable local communication socket without properly authenticating connecting processes.
An attacker with local access could potentially exploit this weakness to obtain root privileges.
For organisations operating Check Point infrastructure, this deserves immediate attention because the affected systems are part of the enterprise security control plane.
Action: Apply Check Point’s recommended remediation, restrict local shell access and review DynamicCLI activity for suspicious privilege escalation attempts.
Final Word
Twelve vulnerabilities. Multiple vendors. Different technologies. One common thread: exploitation has moved these weaknesses beyond routine vulnerability management.
The real challenge is not identifying vulnerabilities. Most organisations already have tools capable of doing that.
The challenge is knowing which vulnerabilities exist in business-critical assets, which are exposed and whether remediation has actually happened.
Don’t measure vulnerability management by the number of findings closed. Measure it by the exposure eliminated.
