Google Chrome CVE-2026-125350 + 6 more

From Microsoft's Patch Tuesday of November 10 (US time) and CISA's newly added KEV (Known Exploited Vulnerabilities) entries, we picked seven items relevant to Japanese small and mid-sized businesses. Two are top priority. Google Chrome CVE-2026-125350 (a use-after-free in the XML component) is one for which Google states that an exploit exists in the wild; update to Chrome 157.0.8103.50/.51. Microsoft Outlook CVE-2026-124194 (spoofing) is also exploited: opening a crafted message file can leak an NTLMv2 hash. Check your Microsoft 365 Apps / Office updates today.

Organizations running a Barracuda Email Security Gateway (ESG) face a chain of CVE-2026-116606 and CVE-2026-111560 that can give an attacker root access, and Barracuda confirms exploitation against a small number of organizations. CISA set a short remediation deadline of November 13. The four items covered in yesterday's (November 10) digest, including OpenSSH, are not repeated in today's list.

This is a use-after-free (reuse of freed memory) vulnerability in Chromium's XML component. Visiting a crafted HTML page may allow arbitrary code execution inside the browser sandbox. The Chrome release notes state: "Google is aware that an exploit for CVE-2026-125350 exists in the wild." Chromium rates it High, and the secondary CVSS 3.1 score listed in NVD is 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). CISA added it to KEV on November 10 with a November 24 deadline.

Affected are Chrome versions before 157.0.8103.50 (per NVD). The fixed versions are 157.0.8103.50/.51 for Windows and Mac and 157.0.8103.50 for Linux, rolling out over days to weeks. The update contains nine security fixes, and CVE-2026-125350 was reported anonymously on November 6. Chromium-based browsers such as Microsoft Edge and Opera may also be affected. The Microsoft Edge security release notes say, as of November 9, that Microsoft is aware of recent exploits in the wild and is working on a fix, but we could not find an Edge version that fixes this CVE at the time of checking. Wait for Microsoft's announcement for Edge.

To check, open the Chrome menu, choose "Help" then "About Google Chrome," confirm the version is 157.0.8103.50 or later, and press "Relaunch" to apply it. Chrome keeps running the old version until it is restarted, so make sure every company PC has been relaunched. For OS-specific check commands and company-wide rollout steps, see Chrome CVE-2026-125350: How to Check and Patch. Sources: Chrome Releases (Stable Channel Update for Desktop), CISA KEV.

This flaw lets Outlook connect to an external network location without showing the usual warning. If an attacker sends a crafted message file and the user opens it, Outlook may connect to an attacker-controlled server and hand over the user's NTLMv2 hash (authentication information used for sign-in). The attacker could then try to authenticate to other internal services as that user. Microsoft rates it Moderate with CVSS 3.1 of 6.5. Microsoft has confirmed exploitation (Exploitation Detected), and CISA added it to KEV on November 10 with a November 24 deadline.

According to Microsoft, the Preview Pane is not an attack vector; the user must open the message file. The updates cover Microsoft 365 Apps (Enterprise), Office LTSC 2021 (build 16.0.14334.21048), and Office LTSC 2024 (build 16.0.17932.21140). To check, go to Outlook's "File" > "Office Account" > "Update Options" > "Update Now," and compare your build against the Microsoft 365 Apps security updates list. Source: MSRC CVE-2026-124194.

CVE-2026-116606 is an authentication bypass in Barracuda's Email Security Gateway (ESG): an unauthenticated attacker can call the configuration-import function and restore a crafted backup, modifying the appliance's global configuration. According to Mandiant, ESG versions earlier than 9.4.0.030 are affected, with a CVSS 4.0 score of 9.3. Barracuda's advisory says a November 5 update changed the authentication field to "administrative UI access required," so the attacker must be able to reach the admin interface.

CVE-2026-111560 is a command injection in which an attacker with administrator privileges embeds OS commands in the timezone setting, which then run as root. ESG, Load Balancer ADC, Message Archiver (BMA), WAF Control Center (WCC), Web Application Firewall (WAF), and Web Security Gateway (WSG) are affected, with a CVSS 4.0 score of 8.6 (Mandiant). Barracuda says that used together, the two flaws let an attacker bypass authorization and obtain root access, and its November 9 update states it identified exploitation activity affecting a small number of organizations. CISA added both to KEV on November 10 with a November 13 deadline and flagged forensic triage as required.

The fixes are BNSF-40425 (9.4.017 and later) or BNSF-40430 (earlier than 9.4.017) for ESG, BNADC-16586 for ADC and WAF, BNMA-32468 for BMA, BNWF-60060 for WCC, and BNYF-24789 for WSG. If auto-patching is off, patches are not installed, so check the firmware and patch status in the appliance's admin UI and apply manually or enable auto-patching. Barracuda recommends keeping admin interfaces off the internet and limited to trusted internal networks. The public page lists no indicators of compromise (IOCs), so confirm any suspected compromise with vendor support. Sources: Barracuda advisory, Mandiant MNDT-2026-0042.

Of the roughly 1,360 entries in Microsoft's published November data, Outlook is the only one confirmed as exploited. Two others are rated Critical with CVSS 9.8. The first is Windows LDAP CVE-2026-119958, an out-of-bounds write that lets an unauthenticated attacker run code in the context of the LDAP service via crafted LDAP calls; Active Directory domain controllers are a notable concern. The second is Windows Search CVE-2026-116928, in the Windows Search component that Exchange Server uses to index attachments. According to Microsoft, processing starts without the recipient opening the email or attachment.

Microsoft rates both "Exploitation Less Likely," and no exploitation is confirmed. But with CVSS 9.8 (AV:N/AC:L/PR:N/UI:N) and no authentication or user action needed, servers should not be left behind. Fixes are in the November cumulative updates, for example KB5131090 (10.0.20348.5870) for Windows Server 2022, KB5131085 (10.0.17763.9487) for Windows Server 2019, KB5131291 (10.0.14393.9688) for Windows Server 2016, KB5131096 (10.0.19045.7846) for Windows 10 22H2, KB5131087 (10.0.22631.7711) for Windows 11 23H2, and KB5132061 for Windows 11 24H2 and 25H2 (10.0.26100.9974 and 10.0.26200.9974 respectively). For Exchange Server, update KB5133453 (15.02.2562.057) also addresses a separate CVE-2026-118207 (remote code execution, CVSS 8.8, not exploited). Check your Windows version under "Settings" > "System" > "About," or run winver. Sources: MSRC CVE-2026-119958, MSRC CVE-2026-116928.

This is an XML external entity (XXE) flaw in the XML parser of Cisco BroadWorks' OCI-P service. An unauthenticated attacker sending a crafted XML message may read files accessible to the BroadWorks user. Cisco rates it CVSS 3.1 7.5 (High). BroadWorks Application Delivery Platform, Application Server, Profile Server, and Xtended Services Platform before RI.2026.07 are affected; the fixed release is RI.2026.07. There is no workaround.

CISA added it to KEV on November 10, but Cisco's advisory (version published August 19, 2026) states it is not aware of malicious use. The public sources therefore do not show the exploitation evidence behind the KEV listing. BroadWorks is mainly used by carriers and large cloud telephony providers, and few small businesses run it themselves. If you subscribe to a cloud phone service, ask your provider whether it has applied the fix. Source: Cisco security advisory.

- Open Chrome on every PC, update from "About Google Chrome," and relaunch (157.0.8103.50 or later)
- If you use Edge, check for updates and wait for Microsoft's announcement
- Run the Microsoft 365 Apps update, including Outlook, and restart Outlook
- Before opening message files or Office files from unknown senders, confirm with the sender
- If you use Barracuda products (ESG, WAF, etc.), confirm patches are applied right away (CISA's deadline for US federal agencies is November 13) and keep the admin UI off the internet
- Run Windows Update, and ask the people in charge of Windows Server, domain controllers, and Exchange Server to apply the November updates
- Ask the vendors of equipment you maintain whether the products above are in use and what their status is

- Chrome CVE-2026-125350: How to Check and Patch
- SMB Patch and Update Management Guide
- Vulnerability Assessment Cost Guide
- Yesterday's Digest (OpenSSH and more)

- Chrome Releases: https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_018223192.html
- CISA KEV Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
- NVD CVE-2026-125350: https://nvd.nist.gov/vuln/detail/CVE-2026-125350
- MSRC CVE-2026-124194: https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-124194
- MSRC CVE-2026-119958: https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-119958
- MSRC CVE-2026-116928: https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-116928
- Microsoft Edge Security Release Notes: https://learn.microsoft.com/en-us/deployedge/microsoft-edge-relnotes-security
- Barracuda advisory: https://trust.barracuda.com/security/pre-authentication-authorization-bypass-command-injection
- Mandiant MNDT-2026-0042: https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2026/MNDT-2026-0042.md
- Cisco cisco-sa-bworks-xxe-uwUd7CEt: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-bworks-xxe-uwUd7CEt