HIGH/ NOVEMBER 11, 2026TODAY’S BRIEFING — #236
Microsoft Outlook zero-day exploited; Git RCE in recursive clones; Xen auth bypass active
Microsoft's November Patch Tuesday addresses 1,200+ flaws including an actively exploited Outlook zero-day (CVE-2026-124194). Git 2.56.1 patches a remote code execution flaw in recursive clones. Xen Orchestra auth bypass being weaponized in the wild.
CVE-2026-124194Microsoft Office — Product ui does not warn user of unsafe actions in Microsoft Office Outlook allows an unauthorized attacker to perform spoofing over a network. · In CISA KEVCVE-2026-105133Ahsay AhsayCBS — A vulnerability was detected in Ahsay AhsayCBS up to 9.15.2.69/10.3.4.44. · In CISA KEVCVE-2026-105134Ahsay AhsayCBS — A flaw has been found in Ahsay AhsayCBS up to 9.15.2.69/10.3.4.44. · In CISA KEVCVE-2026-111560Barracuda Networks Multiple Products — Improper neutralization of shell metacharacters in the timezone configuration field in certain Barracuda appliance products using common Barracuda code… · In CISA KEV
Read the full briefing →