Good morning. Microsoft’s November updates include an Outlook bug attackers were already using to steal Windows sign-in hashes, and CISA added it to its exploited list on Tuesday along with a Chrome zero-day and the two Barracuda gateway bugs we flagged last week. N-able also shipped its N-central fix.
Coffee first. Then an Office update, a browser restart, a gateway check and one server to upgrade before it goes back online.
Lead Story
Outlook: one opened file leaks the user’s Windows sign-in hash, and attackers are using it. Push the November Office update to every PC and block outbound port 445. The Windows update alone does not fix it.
Don’t Miss the Policy Changes That Affect Security Decisions
Get the key CISA actions, new regulations, guidance, and risk shifts in a quick daily brief.
By subscribing you agree to our Privacy Policy.
Free. Weekday mornings. 5 minutes or less.
Also Worth Your Attention
Chrome: an XML bug with an exploit in the wild. Get every browser to 157.0.8103.50 and force a restart, because the fix does nothing until Chrome relaunches.
Barracuda email gateways: the bugs we flagged are now exploited. Confirm the patch landed, keep the admin page off the internet and check for a tampered config before Friday.
N-central: the fix is out and scanning has started. Install 2026.4 HF2 and update agents and probes before the server reconnects.
On the radar
- SAP’s November patch day fixes four bugs rated 10.0, including the ICM2SHELL pair in NetWeaver’s Internet Communication Manager and Web Dispatcher. No attacks reported yet. Apply SAP Notes 3778530 and 3778556. Onapsis.
- Vates says a Xen Orchestra authentication bypass (VSA-2026-062) is being exploited to take over XCP-ng hosts. Update to 6.9.1 or 6.10.0. BleepingComputer.
- CISA also added a Cisco BroadWorks XML bug, CVE-2026-20320, to its exploited list on Tuesday. CISA alert.
Slack paste
Today’s brief: (1) Outlook CVE-2026-124194: push the November Office update, block outbound 445, KEV due Nov 24. (2) Chrome CVE-2026-125350: 157.0.8103.50 and force a relaunch. (3) Barracuda ESG: confirm the patch, admin page off the internet, KEV due Nov 13. (4) N-central: install 2026.4 HF2, update agents and probes, then reconnect.
Go Deeper
Identity and access: IAM library. Tools and checkers: cybersecurity tools. Sorting this month’s patches? Our patch priority checklist puts exploited bugs first.
Start your morning with the signal that matters.
Get the biggest cybersecurity developments, why they matter, and where to go deeper on CyberExperts.
By subscribing you agree to our Privacy Policy.
Free. Weekdays. Built for operators.
