November 2026 Patch Tuesday and KEV surge: verified incident tracker

Three days collapsed into one patch queue. Over the weekend of November 8, a researcher dropped more than thirty unpatched zero-days in N-able N-central and NEAR AI confirmed an attacker had run code on one of its inference servers. On November 9 and 10, CISA added seven more exploited flaws to its catalog — a pre-auth bypass in Barracuda's email gateway, an IBM Aspera authorization bypass, a FreeSwitch RCE, a Cisco BroadWorks XXE, an Outlook spoofing zero-day and the eighth exploited Chrome zero-day of the year — and Microsoft shipped its November Patch Tuesday on top. The feeds and the viral timelines are now a wall of "critical." This page separates what is confirmed from what is not, and orders the fixes.

Developing story — first published 20:45 CET (19:45 UTC), November 10, 2026. Updated as vendors and CISA publish more.

Patch today

Five items are both internet-reachable (or user-triggerable) and confirmed exploited. Everything else can queue behind them.

1. Barracuda Email Security Gateway — CVE-2026-116606 + CVE-2026-111560. An authentication bypass (CVSS 9.3) that lets an unauthenticated attacker who can reach the admin interface restore a crafted configuration backup, chained with an OS command-injection (CVSS 8.6) to get root. Barracuda's advisory, updated November 9, states exploitation "affecting a small number of organizations." ESG is the same product line mass-compromised by UNC4841 in 2023, so treat any exposed appliance as a priority. Fixed from ESG 9.4.0.030 (Mandiant MNDT-2026-0042); Barracuda pushes the patch automatically — confirm it landed. KEV due 2026-11-13, forensic triage required.
2. IBM Aspera Faspex — CVE-2026-123218. An incorrect-authorization bug (CVSS 9.8) that lets an authenticated user craft a message to gain administrative privileges. Faspex is a file-exchange server that tends to sit on the perimeter, and the 2023 ransomware wave against CVE-2022-47986 is the precedent nobody wants repeated. Fixed in 5.0.19 PL1 per IBM's advisory. KEV due 2026-11-12, forensic triage required.
3. SignalWire FreeSwitch — CVE-2026-116779. A SIP MESSAGE code-injection (CVSS 9.8) that reaches OS command execution as the daemon. Vanilla installs ship passwordless default users, so the barrier is often config, not a password. Fixed in 1.11.3 — our full breakdown and runbook covers the enable-chat=false compensating control. KEV due 2026-11-12.
4. Microsoft Outlook — CVE-2026-124194. The one actively exploited zero-day in this month's Patch Tuesday (CVSS 6.5, "moderate"): opening a crafted Office file makes Outlook authenticate outbound to the attacker and leak the user's NTLMv2 hash, which cracks offline or relays live. A 2026 recurrence of the forced-auth class. Our analysis and mitigation steps include blocking outbound SMB. KEV due 2026-11-24.
5. Google Chrome — CVE-2026-125350. A use-after-free in the XML component, the eighth exploited Chrome zero-day of 2026, fixed in 157.0.8103.50/.51. The patch only takes effect after a full relaunch — a version string of 157 lies if the browser was never closed. Details in our Chrome write-up. KEV due 2026-11-24.

Verified incident tracker

Every row below was checked against a primary source — a vendor advisory, the CISA KEV catalog entry, NVD, or the affected company's own statement. ✅ confirmed · ⚠️ partly confirmed · ❌ not supported by any source.

Incident	What it is	Status	Fix / action	Source
Barracuda ESG CVE-2026-116606 + -111560	Pre-auth bypass chained to root RCE; exploitation observed	✅	ESG 9.4.0.030 (auto-patched); other products per advisory	Barracuda · Mandiant
Microsoft Outlook CVE-2026-124194	Exploited zero-day; forced-auth NTLMv2 hash leak	✅	November Patch Tuesday build	MSRC · our post
Google Chrome CVE-2026-125350	8th exploited Chrome zero-day of 2026; UAF in XML	✅	157.0.8103.50/.51 + full relaunch	our post
IBM Aspera Faspex CVE-2026-123218	Authz bypass to admin; on CISA KEV	✅	5.0.19 PL1	IBM
SignalWire FreeSwitch CVE-2026-116779	SIP MESSAGE code injection to daemon RCE	✅	1.11.3	our post
OpenSSH "SSHole" CVE-2026-123158	Added to KEV 2026-11-09; auth bypass on musl builds	✅	10.6p2	our post
GPUStack CVE-2026-102895	AI-infra RCE (CVSS 9.8); exploited since July, KEV 2026-11-09	✅	Vendor fixed release	NVD
Openwave Webtop Media Transcoder CVE-2026-111793	Niche webmail transcoder; developer confirms attacks seen	✅	1.1.22.0 / Media Server 2.0	JVN
NEAR AI breach via SGLang RCE	RCE in LLM inference engine; ~100 users' details taken	✅	Fix deployed; no public CVE yet	NEAR AI
BOSSAI Taipei emergency-dispatch theft	One operator, AI agents, exposed APIs and default creds	✅	Harden exposed services	our post
Cisco BroadWorks CVE-2026-20320	XXE config disclosure; on KEV, vendor "not aware" of use	⚠️	RI.2026.07	Cisco
N-able N-central "Able2Shell" (30+ bugs)	PoCs public; no CVEs yet; vendor sees no exploitation	⚠️	Keep offline; apply hotfix	our post
Windows NTFS CVE-2026-100223	Flagged "exploited" by feeds; MSRC says not exploited	❌	Routine Patch Tuesday fix	MSRC

Rotate these secrets

Two of this week's incidents put credentials in the attacker's hands, so patching alone does not close them.

• NEAR AI Cloud users. NEAR AI confirmed two customers' Cloud API keys were exposed in logs and has revoked them, replaced all agent tokens and invalidated active sessions. If you held NEAR AI credentials, assume anything that touched that platform may have been observed and rotate your own downstream keys.
• Barracuda ESG operators. If an exposed appliance was reachable before you patched, the bypass allowed configuration import — review the running config, rotate appliance and bound service credentials, and check for unexpected administrator accounts before you trust the box again.
• FreeSwitch and IBM Faspex. Both bugs reach credentialed functions; after patching, rotate SIP/profile secrets (FreeSwitch) and administrative accounts (Faspex), and confirm no new accounts were created.

What the feeds got wrong

The watchers and viral timelines ran ahead of the evidence in three places.

"Another exploited Windows zero-day." CVE-2026-100223, a Windows NTFS elevation-of-privilege bug, rode into several feeds this week tagged as exploited. Microsoft's own advisory says the opposite: not publicly disclosed, not exploited, "Exploitation Less Likely," CVSS 7.8, and local-only — you already have to be on the box. It is a routine Patch Tuesday fix, not a zero-day. Patch it in the normal cycle, not tonight.

"33 zero-days being exploited in N-able." The N-able N-central disclosure is real and the researcher published working proof-of-concept code, but N-able says it has no evidence the flaws have been exploited against its environments, and no CVE IDs have been assigned yet. "PoC public" and "exploited in the wild" are different claims; this is the former. The right action — keep hosted and on-prem consoles offline until the hotfix — does not depend on which it is.

Cisco BroadWorks "exploited." CISA added CVE-2026-20320 to KEV as exploited, but Cisco's PSIRT advisory still states it is "not aware of any public announcements or malicious use." The two can both be current — CISA sees telemetry the vendor does not — but if you are deciding urgency, note the disagreement rather than treating it as settled. Fixed in RI.2026.07.

"We patched everything on the KEV list." — "Including the one the vendor says isn't exploited, and the Windows bug that was never on KEV? Which internet-facing appliance did you do first?"

How to prioritize when everything is critical

A week like this is exactly what CISA's BOD 26-04 risk tiers are for: the shortest three-day deadline is reserved for the flaws that are both exploited and reachable, which is why Barracuda, FreeSwitch, IBM Aspera and SSHole carry a 2026-11-12/13 due date while the Outlook and Chrome client bugs sit at 2026-11-24. Order your own queue the same way — internet-facing and exploited first, local or unexploited last — and before you push a change, confirm the asset is actually reachable and the flaw is actually exploitable in your configuration. The CISA KEV tracker, the Cisco and Microsoft vendor hubs, and a disciplined automated penetration testing pass against your own estate turn "everything is critical" into a ranked list you can actually work.

That ranking is where an autonomous red team earns its place. Zero Hunt runs as an on-premise appliance on its own private models, with a human approving every action that matters: it reasons over the same KEV and advisory feeds, then proves — black-box or gray-box — which of this week's flaws is reachable on your perimeter and exploitable in your build before anyone schedules a change window, and its Remediation Advisor ranks the fixes by demonstrated exploitability, not by how loud the headline was, re-verifying each one with the same test that found the hole. In a week where thirteen incidents arrive at once and one of them turns out not to be exploited at all, that difference is the whole job.