US CISA Mandates Patching for 6 Actively Exploited Vulnerabilities by Nov 13 or 24
The US Cybersecurity and Infrastructure Security Agency (CISA) added six actively exploited vulnerabilities to its KEV catalog, setting urgent patching deadlines for federal agencies.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) announced on November 10 that it has added six new vulnerabilities with evidence of active exploitation to its Known Exploited Vulnerabilities (KEV) catalog, mandating that U.S. federal agencies patch them within specific deadlines.
Affected products include Microsoft Outlook, Google Chrome, several Barracuda Network devices (such as ADC, WAF, WSG, BMA, WCC, and Email Security Gateway), Cisco BroadWorks, and Openwave Webtop Media Transcoder.
CISA set different compliance dates based on the urgency of the flaws. Two vulnerabilities affecting Barracuda products (CVE-2026-111560 and CVE-2026-116606) are considered most critical, requiring federal agencies to complete patching by November 13. The remaining four vulnerabilities have a deadline of November 24.