Critical Zoom RCE, Microsoft Patch Tuesday 1,093 fixes, Chromium use-after-free exploited

Executive Summary

• Zoom released patches for two critical privilege-escalation vulnerabilities (CVE-2026-108186, CVE-2026-108187) affecting Workplace for Windows; no [exploitation unverified] reported.
• Microsoft shipped 1,093 security fixes in its latest Patch Tuesday, including a spoofing bug in Outlook (CVE-2026-124194) already being exploited in the wild.
• Google Chromium use-after-free vulnerability (CVE-2026-125350) is actively exploited; affects Chrome, Microsoft Edge, Opera, and other Chromium-based browsers; CISA KEV addition mandates federal patching by November 24.
• Barracuda Networks Email Security Gateway authentication bypass (CVE-2026-116606) added to CISA KEV with November 13 federal remediation deadline; chainable with CVE-2026-111560.
• OpenSSH SSHole vulnerability (CVE-2026-123158), a decade-old flaw in musl-based systems, is under active exploitation; patch 10.6p2 released November 5.

Top Threats Today

1. Zoom Workplace Critical Privilege-Escalation Vulnerabilities

Severity: CRITICAL   Affected: Technology

Zoom has released updates addressing two critical security flaws in Zoom Workplace for Windows that could allow unauthenticated remote attackers to escalate privileges ^[1]. CVE-2026-108186, rated CVSS 9.6, stems from improper input validation and permits unauthenticated users to escalate privileges via network access ^[1]. CVE-2026-108187, rated CVSS 8.1, is an origin validation bypass allowing similar privilege escalation ^[1]. CVE-2026-108186 affects versions 7.1.0 through 7.1.7; CVE-2026-108187 affects versions before 7.1.5 ⚠^[1]. Both are fixed in Zoom Workplace for Windows version 7.1.8 and 7.1.5 respectively ^[2]. Zoom reports no evidence of either vulnerability being actively exploited in the wild ^[1].
Sources:[1] The Hacker News[2] SecurityWeek

2. Microsoft Outlook Spoofing Vulnerability Under Active Exploitation

Severity: HIGH   Affected: Technology Finance Government

Microsoft's November Patch Tuesday addressed 1,093 vulnerabilities, including one spoofing bug in Outlook (CVE-2026-124194) that is already being actively exploited in the wild ^[1][2]. The vulnerability, rated CVSS 6.5, affects Microsoft 365 Apps for Enterprise and Microsoft Office editions ^[1]. An attacker can send a specially crafted message file; if a user opens it in an affected Outlook version, the application may connect to an attacker-controlled network location without displaying the usual external-content warning, potentially disclosing authentication information usable to impersonate the user ^[2]. Microsoft credits advances in artificial intelligence for helping identify such a large volume of security bugs this month ^[1]. CISA has added CVE-2026-124194 to its Known Exploited Vulnerabilities catalog and mandated federal agency patching by November 30 ⚠^[2].
Sources:[1] Krebs on Security[2] The Record

3. Google Chromium Use-After-Free Remote Code Execution Under Active Exploitation

Severity: CRITICAL   Affected: Technology

Google Chromium contains a use-after-free vulnerability in the XML component (CVE-2026-125350) that allows a remote attacker to execute arbitrary code inside the sandbox via a specially crafted webpage ^[1]. The flaw affects multiple web browsers utilizing Chromium, including Google Chrome, Microsoft Edge, and Opera ^[1]. CISA has added CVE-2026-125350 to its Known Exploited Vulnerabilities catalog, requiring federal agencies to apply patches by November 24 ^[1]. The vulnerability is actively being exploited according to CISA's KEV designation ^[1].
Sources:[1] CISA KEV

4. Barracuda Email Security Gateway Authentication Bypass and Configuration Takeover

Severity: HIGH   Affected: Technology Finance Government

Barracuda Networks Email Security Gateway (ESG) contains an authentication bypass vulnerability (CVE-2026-116606) allowing an unauthenticated remote attacker to invoke a configuration-import function and restore a crafted, compatible backup archive, resulting in unauthorized modification of the appliance's global configuration ^[1]. This vulnerability can be chained with CVE-2026-111560 for broader impact ^[1]. CISA added CVE-2026-116606 to its Known Exploited Vulnerabilities catalog on November 10, 2026, with a federal agency remediation deadline of November 13 ^[1]—indicating active exploitation and urgent risk.
Sources:[1] CISA KEV

5. OpenSSH SSHole Authentication Bypass on musl-Based Linux Under Active Exploitation

Severity: HIGH   Affected: Technology

A decade-old vulnerability in OpenSSH (CVE-2026-123158, CVSS 8.1), nicknamed SSHole, allows attackers to bypass password authentication on certain Linux systems and install backdoors ^[1]. The flaw affects OpenSSH running with the musl C library under specific authentication configurations, particularly Alpine Linux and musl-based systems ^[1]. The vulnerability dates to a 2016 OpenSSH change addressing username enumeration; musl's crypt() function returns an asterisk when hashing fails on passwords 257–1,024 bytes long, which OpenSSH mistakenly treats as a matching password hash ^[1]. Exploitation requires SSH password authentication to be enabled, PAM to be disabled, an account with an asterisk in its password field, and at least one other local account with a valid password hash ^[1]. OpenSSH version 10.6p2, released November 5, 2026, fixes the vulnerability ^[1]. Public proof-of-concept code appeared within four hours of the fix; security firm watchTowr observed exploitation linked to botnet and cryptocurrency-mining activity on November 6 ^[1]. Debian, Ubuntu, and systems using glibc or PAM are not affected ^[1].
Sources:[1] HackRead

Today’s Action Checklist

• ☐ URGENT (deadline Nov 13): Patch Barracuda ESG for CVE-2026-116606; restrict network access to admin interfaces
• ☐ URGENT (deadline Nov 24): Update all Chromium-based browsers (Chrome, Edge, Opera) for CVE-2026-125350; enable automatic updates
• ☐ URGENT: Apply Microsoft November patches to all Office and Microsoft 365 instances for CVE-2026-124194
• ☐ HIGH: Update Zoom Workplace for Windows to 7.1.8 or 7.1.5 depending on current version
• ☐ HIGH: Upgrade OpenSSH to 10.6p2 on all musl-based Linux systems and Alpine containers
• ☐ ONGOING: Review earlier briefings on Microsoft Outlook zero-day and related Xen vulnerabilities and OpenSSH and N-able CVE coverage for context on active exploitation campaigns