Security Act now
CISA KEV additions through 10 November 2026 and clashing patch totals
From 3 to 10 November 2026, CISA added exploited vulnerabilities to its KEV catalog, including Outlook flaw CVE-2026-124194. Three reports put Microsoft’s 10 November patch total at 1,094, 1,093 and 1,259.
CISA's Known Exploited Vulnerabilities catalog gained entries on 3, 4, 6, 9 and 10 November 2026, each tied to evidence of active exploitation. Binding Operational Directive 26-04, Prioritizing Security Updates Based on Risk, orders only Federal Civilian Executive Branch agencies to patch first the high-risk catalog CVEs on internet-facing systems that exploitation would fully control, to postpone lower-risk bugs, and to look for pre-patch compromise. CISA encourages all other organizations to prioritize the same catalog entries.
The entries are CVE-2026-119977, a WordPress core time-of-check time-of-use race (3 November); CVE-2024-27834, improper authentication in multiple Apple products (4 November); CVE-2026-19868, single-factor authentication in SonicWall SonicOS SSLVPN (6 November); CVE-2026-102895, GPUStack improper authentication; CVE-2026-116779, SignalWire FreeSwitch code injection; CVE-2026-123158, an unexpected status code or return value in OpenBSD OpenSSH; CVE-2026-123218, incorrect authorization in IBM Aspera Faspex (all four on 9 November); CVE-2026-20320, improper restriction of XML external entity references in Cisco BroadWorks; CVE-2026-111560, OS command injection in multiple Barracuda Networks products; CVE-2026-111793, incorrect resource transfer between spheres in Openwave Messaging Limited Webtop Media Transcoder; CVE-2026-116606, authentication bypass using an alternate path or channel in Barracuda Networks Email Security Gateway; CVE-2026-124194, missing user interaction for a potentially unsafe action in Microsoft Office Outlook; and CVE-2026-125350, a Google Chromium use-after-free (all six on 10 November).
Microsoft's 10 November patch totals differ. CyberScoop reported 1,094 CVEs (about 1,090), 726 in Windows and 174 in Office, none public before release, and one exploited bug, CVE-2026-124194: a crafted message file makes Outlook reach an attacker-controlled network location with no usual external-content warning. Krebs on Security reported 1,093 fixes, 63 of them critical, and 535 that allow privilege elevation, and said that Outlook bug, in Microsoft 365 Apps for Enterprise and Office editions, is the only one already exploited. The Hacker News reported 1,259 vulnerabilities.