Email and Employee Protection

Outlook and Barracuda ESG in KEV: exploited flaw exposes NTLMv2 hashes, and a two-bug chain grants root on gateway

On November 10, 2026, CISA added CVE-2026-124194 in Outlook and two flaws in the Barracuda Email Security Gateway to its Known Exploited Vulnerabilities (KEV) catalog. That same day, Microsoft patched the Outlook vulnerability in its record-setting November update bundle.

  • SourceCISA
  • Source publicationNovember 10, 2026
  • TypeThreats and incidents

What happened

Outlook. According to the NVD, in the case of CVE-2026-124194, the Outlook interface fails to warn users about unsafe actions, enabling network-based spoofing. The CVSS 3.1 score is 6.5: the attack requires no privileges, but user interaction is required. Jack Bicer of Action1 detailed the mechanism in Infosecurity Magazine: an attacker sends a crafted message file, and upon opening it, Outlook connects to an attacker-controlled network location without the standard external content warning. This connection can leak the user’s NTLMv2 hash, which can subsequently be used to authenticate on their behalf. Microsoft 365 Apps for Enterprise as well as Office LTSC 2021 and 2024 are vulnerable. CISA has set a compliance deadline of November 24, 2026, for US federal agencies.

Patch bundle. Infosecurity Magazine reports that Microsoft’s November release addresses 1,235 vulnerabilities, including 66 critical flaws, marking the fourth record-breaking month this year. Other outlets tally the numbers differently, reporting figures ranging from roughly 1,100 to over 1,250.

Barracuda ESG. CVE-2026-116606 (CVSS 9.3) is an authentication bypass in versions prior to 9.4.0.030. According to Mandiant, an unauthenticated attacker can trigger a configuration import and upload a crafted backup. CVE-2026-111560 (CVSS 8.6) is a command injection flaw in the timezone setting that grants root privileges to an administrator. Barracuda confirmed that chaining both flaws results in complete appliance takeover. CISA deadline: November 13, 2026.

Key findings

  • CVE-2026-124194 (Outlook, CVSS 6.5): NTLMv2 hash leak upon opening a crafted message file; vulnerability is actively exploited.
  • A patch is included in the November Office updates; threat actors and attack scale remain unknown.
  • CVE-2026-116606 and CVE-2026-111560 (Barracuda ESG): chained together grant root on the gateway; added to KEV on November 10, 2026.
  • The second flaw also impacts other Barracuda products, including Web Application Firewall and Message Archiver.
  • Barracuda recommends restricting administrative interface access strictly to trusted internal networks.

Why it matters

SafeWave CommentaryBoth issues involve email, but target different vectors: the first impacts employee accounts, while the second targets the appliance intended to filter that email. An NTLMv2 hash is not a plaintext password, but across networks that still accept NTLM, it is often sufficient for user impersonation. Action items: deploy the Office update, prioritizing administrators and privileged accounts; block outbound SMB traffic (port 445) to the internet at the perimeter; audit where NTLM remains active across the organization and restrict it where feasible; verify the Barracuda ESG version and ensure the administrative console is not exposed to the internet. We previously covered deprecating legacy protocols in Active Directory in our analysis on RC4. More: Email and Employee Protection.