Vulnerabilities of the week: management interfaces without a password

This roundup covers 9 to 13 November 2026. Four of the five items have one thing in common: an attacker gets into an interface that manages something else, and needs no password to do it. The Barracuda email gateway, the Xen Orchestra virtualisation console, FortiManager firewall management and the Cisco BroadWorks voice platform each have a flaw where network access to the management interface is enough. The fifth item is Outlook, which leaks the signed-in user authentication hash after a single crafted file is opened.

Three items from this week were already covered in separate alerts and we do not repeat the detail here. The exploited Chrome flaw (CVE-2026-125350) is in our alert of 11 November, and the critical Apache HTTP Server flaw fixed in 2.4.71 (CVE-2026-119618) in our alert of 12 November. For the OpenSSH flaw on Alpine Linux (CVE-2026-123158) we added on 12 November that CISA has listed it in the Known Exploited Vulnerabilities catalogue.

If you only have time for one thing, make it Barracuda. The vendor has confirmed that attacks are under way and the deadline for US federal agencies to fix both flaws is today.

The exploited Xen Orchestra flaw is missing from the table because no CVE has been assigned yet. The vendor tracks it as VSA-2026-062.

1. Barracuda, two flaws chained into root on the email gateway

CVE-2026-116606 and CVE-2026-111560 · CVSS scores 9.3 and 8.6 · actively exploited · patch available

The Barracuda Email Security Gateway (ESG) is an appliance that filters mail before it reaches company mailboxes. The second flaw affects further products from the vendor as well: the Load Balancer and ADC, the Message Archiver, the Web Application Firewall and its Control Centre, and the Web Security Gateway.

The first flaw (CVE-2026-116606) is a pre-authentication authorisation bypass. An attacker who can reach the administrative interface can invoke the configuration import function and restore a crafted backup archive, which changes the global configuration of the appliance. On 5 November Barracuda clarified that no authentication is required, only access to the administrative interface. The second flaw (CVE-2026-111560) is an OS command injection through a crafted timezone value. It runs with root privileges but requires administrative access. Chained together, the two give full control of the appliance.

This is worse than it looks for two reasons. The email gateway sits on the perimeter and sees all company mail, so root on it means access to the content of communication and a starting point for moving into the internal network. And on 9 November the vendor added that it has observed exploitation affecting a small number of organisations. CISA listed both flaws in the Known Exploited Vulnerabilities catalogue on 10 November with a deadline for US federal agencies of 13 November 2026.

The second flaw in the chain, CVE-2026-111560 with a CVSS score of 8.6, also affects further appliances from the vendor. The US federal deadline is 13 November 2026.

What to do. Verify that the appliances run the latest firmware and have the security patches applied. For the ESG these are BNSF-40425 for firmware 9.4.017 and later and BNSF-40430 for earlier builds, for the ADC and Web Application Firewall BNADC-16586, for the Message Archiver BNMA-32468, for the WAF Control Centre BNWF-60060 and for the Web Security Gateway BNYF-24789. If automatic patching is switched off, apply the patches manually and turn automatic patching back on. Do not leave the administrative interface reachable from the internet, it belongs in a dedicated management network or behind a VPN. If it was reachable, review configuration changes and accounts on the appliance and rotate the secrets stored on it.

2. Xen Orchestra, an empty cookie instead of a login to the virtualisation console

No CVE identifier assigned, the vendor tracks the flaw as VSA-2026-062 · rated critical by the vendor, no CVSS score assigned yet · actively exploited · patch available

Xen Orchestra is the web console used to manage virtual machines, hosts and pools of the XCP-ng platform, including backups. On 10 November the French vendor Vates published advisory VSA-2026-062 and confirmed that the flaw is being exploited.

The flaw lies in the way the REST interface of the xo-server component parses the authentication cookie. When an attacker sends an empty JSON object in it, the server passes that object to the token provider, which treats it as an unfiltered lookup and returns the first token in the collection. If the token is still valid, the attacker is authenticated as its owner. No password and no valid token are needed, only network access to the management interface. From the authenticated part of the interface the attacker can then retrieve reusable login token identifiers.

According to the advisory, an attacker can act with Admin privilege, run code on managed pools and take over an XCP-ng host as root. A compromise of the console therefore means a compromise of the whole environment it manages, backups included. The flaw has no CVE identifier and no CVSS score so far, and as of today it is not in the CISA catalogue, but exploitation was confirmed by the vendor itself, which also published indicators of compromise. Successful exploitation leaves no trace of unauthenticated access in ordinary logs and can only be spotted through HTTP monitoring.

What to do. Update to Xen Orchestra 6.9.2 on the stable channel (package xo-server 5.211.2) or to 6.10.1 on the latest channel (xo-server 5.213.1). Earlier versions are vulnerable, and source installations should be updated to current master. Checking the version of the xo-server package is more reliable than the appliance version number. Until you can update, move the console into a dedicated management network, do not leave it reachable from the internet, and block the IP addresses listed in the advisory as well as traffic to the Tor network. A reverse proxy or WAF rule that drops requests with an empty cookie is a stopgap only, because the pattern can be bypassed with a different encoding. Review HTTP records against the vendor indicators, and if you suspect a compromise, rotate the passwords and secrets of the whole environment, from the pool secret to backup storage credentials. On the same day Vates also published advisory VSA-2026-063 on virtual machine import, where it recommends allowing import to administrators only.

3. Outlook leaks a user hash after a single file is opened

CVE-2026-124194 · CVSS score 6.5 · actively exploited · patch available

The November patch release from Microsoft came out on 10 November and is the second largest to date by number of items. Sources differ on the count depending on what they include: Tenable reports 1,093 flaws, BleepingComputer 1,235. One of them was exploited before the fix was available and it sits in Outlook.

Microsoft describes it as spoofing: the product does not warn the user about an unsafe action. In practice the user only has to open a crafted message file. Outlook then connects to an attacker controlled network location without the usual warning and in doing so leaks the NTLMv2 hash of the signed-in user. That hash can be cracked offline or relayed to another service on the network.

A CVSS score of 6.5 and a Moderate rating from Microsoft look harmless, but three other things matter more. Microsoft says the flaw is being exploited, CISA listed it in the Known Exploited Vulnerabilities catalogue on 10 November with a deadline for US federal agencies of 24 November 2026, and the fix does not arrive through Windows Update. It is in the November Office update, so anyone patching only the operating system still has the flaw open. Public proof of concept code has also appeared.

What to do. Deploy the November Office update. Microsoft released fixes for Microsoft 365 Apps and for Office LTSC 2021 and 2024. New Outlook for Windows, Outlook on the web, Outlook for macOS and the mobile apps are not listed as affected. Until the update is on all workstations, block outbound SMB traffic from client machines to the internet so the hash has nowhere to go, and check that port 445 is not open on the perimeter.

4. FortiManager and FortiAnalyzer, unauthenticated command execution through the JSON-RPC interface

CVE-2026-126170 · CVSS score 9.8 · public proof of concept exploit · patch available for the 7.6 branch, mitigation only for 8.0

FortiManager is the central configuration management for Fortinet firewalls, and FortiAnalyzer collects and analyses their logs. On 10 November Fortinet published advisory FG-IR-26-219 for both products, describing an injection into the JSON-RPC interface through which the products are driven from scripts.

The flaw is improper escaping of output. An unauthenticated attacker can reach command execution with a crafted HTTP request to the /jsonrpc endpoint. The vulnerability exists only where the JSON-RPC interface is enabled, and it is disabled by default.

Why this is worse than it looks: from a system that manages firewall configuration an attacker can rewrite rules across the whole network, and from FortiAnalyzer read what runs where. Fortinet states that it is not aware of exploitation, but proof of concept code is already circulating publicly, which usually shortens the time to the first attempts. One detail to watch: version 8.0.2 from October does not contain the fix and remains vulnerable.

What to do. On the 7.6 branch, update FortiManager and FortiAnalyzer to 7.6.8 or later. Affected versions are 7.6.0 through 7.6.7 and 8.0.0 through 8.0.2, for the cloud variants 7.6.0 through 7.6.7 and 8.0.1 through 8.0.2, and for FortiAnalyzer-BigData 7.6.0 through 7.6.2. Branches 7.2 and 7.4 are not affected. For the 8.0 branch Fortinet names 8.0.3 as the fixed release, which was not yet available when the advisory was published. Until then the mitigation applies: disable the JSON-RPC interface in the administrator profile with set rpc-permit none, or restrict access to the /jsonrpc endpoint on the firewall and watch the logs for unauthenticated POST requests to that endpoint.

5. Cisco BroadWorks, unauthenticated file read

CVE-2026-20320 · CVSS score 7.5 · actively exploited · patch available

Cisco BroadWorks is the platform on which operators and service providers build hosted voice services for business customers. Cisco published the advisory for this flaw back on 19 August 2026, but on 12 November it added that its PSIRT is aware of active exploitation.

The flaw is in the XML parser of the Open Client Interface. The parser allows external entity resolution by default, so an unauthenticated attacker can send a crafted XML message to the OCI-P service and read files from the filesystem with the privileges of the user that BroadWorks runs as. Typically that means configuration files and credentials that can be used to go further.

For most mid-sized companies this is not an item to patch but a question to ask a supplier. If you buy voice services from an operator, the vulnerability is in their system and you need to know whether it has been fixed. This is exactly the situation that supplier security requirements under NIS2 are aimed at.

What to do. If you run BroadWorks yourself, update the Application Delivery Platform, Application Server, Profile Server and Xtended Services Platform to release RI.2026.07. Earlier releases are vulnerable and Cisco states that no workaround addresses the flaw. If you buy the voice service, send your supplier a question about CVE-2026-20320 and about the date the fix will be deployed. CISA listed the flaw in the Known Exploited Vulnerabilities catalogue on 10 November with a deadline for US federal agencies of 24 November 2026.

Priority summary

Elsewhere in security

ENISA published its second report on the state of cybersecurity in the Union

On 10 November the EU agency ENISA published its report on the state of cybersecurity in the European Union, which it prepares under Article 18 of the NIS2 Directive. According to ENISA the level of cyber threats to the Union remains substantial, while overall preparedness is improving. The EU Cybersecurity Index stands at 71.53 points out of one hundred. The weakest areas in the report are the maturity of CSIRT teams (54.76 points) and national certification ecosystems (55.56 points), while supply chain management for essential and important entities scores highest (89.91 points).

According to the Help Net Security summary, the report also states that 45 per cent of surveyed IT service management providers in the Union take more than three months to apply critical patches to critical systems, and that 37 per cent of organisations named supply chain risk management as the hardest NIS2 requirement to implement. ENISA also writes that frontier AI models are industrialising vulnerability discovery and that the bottleneck is shifting to triage and remediation rather than discovery.

Try to answer how long it takes in your organisation for a critical patch on an internet facing system to go from release to deployment. If nobody knows that number, it is the first thing worth measuring.

Europol disrupted the infrastructure behind Gootloader, CastleRAT and StealC

On 12 November Europol announced another action under Operation Endgame. Law enforcement agencies from nine countries, working with Eurojust, acted against the infrastructure of three malware families and seized 235 servers and 257 domains, which yielded 6.4 million victim datasets. According to Europol, Gootloader spread from compromised websites, often built on WordPress, under the guise of fake legal documents and serves for initial access. CastleRAT is a remote access tool, and StealC is an infostealer, that is code which steals credentials from an infected machine and can deliver further malware onto it.

Action against servers does not erase credentials that have already been stolen. If anyone in your organisation ran an infostealer in the past, the passwords and tokens from that machine need to be rotated, including logins saved in the browser.

What to take away from this week

Four of the five items are not flaws in end systems but in the interfaces that manage something else: all company mail, a virtualisation environment, firewall configuration, a voice service. An attacker who gets into a management tool does not gain one server, but everything that tool controls. The defensive rule that follows is simple: management interfaces do not belong on the internet, they belong in a dedicated network or behind a VPN, and the list of those that are visible from the internet should be short and current.

The second observation is less usual. In two advisories from this week the vendor credits people who found the flaw with the help of a frontier AI model: Microsoft for the exploited Outlook flaw and Fortinet for FG-IR-26-219. In its report from the same week ENISA writes that frontier models are industrialising vulnerability discovery and that the bottleneck is moving to triage and remediation. For a company this means one thing: there will be more advisories, and deciding which of them to act on today is work that someone has to own.

A task for this week: write down every management interface that is reachable from the internet, from the email gateway and virtualisation console through firewall and VPN management to backup administration, and decide for each one whether it has to be there. Then keep the list up to date. It is one of the few documents that will tell you next Friday whether a new finding concerns you.

No time to track this?

We publish this roundup every week. Following it is only the first step. The harder part is knowing which vulnerabilities concern you specifically, in what order to deal with them and who in your organisation is accountable for that.

We help with that: security assessment and vulnerability management · outsourced security manager · selection and deployment of technologies

Informal consultation · Dealing with an incident right now?

We will tell you plainly what is worth addressing first. The initial consultation is free of charge.

Sources: CISA, Known Exploited Vulnerabilities catalogue · Barracuda, advisory on the authorisation bypass and command injection · Vates, advisory VSA-2026-062 · Microsoft, CVE-2026-124194 · Fortinet PSIRT, FG-IR-26-219 · Cisco, advisory on the BroadWorks flaw · ENISA, 2026 Report on the State of Cybersecurity in the Union · Europol, results of Operation Endgame · Tenable, count of flaws in the November patch release · BleepingComputer, the November patch release from Microsoft · Help Net Security, Operation Endgame and the ENISA report