If you only do one thing this week, get the November Microsoft updates onto every machine that runs Outlook. Microsoft fixed an Outlook flaw that attackers are already using to steal Windows sign-in hashes through a single opened file, and CISA added it to its Known Exploited Vulnerabilities list on November 10. Right behind it: an exploited SonicWall SSL VPN bug that can skip SAML-based MFA, another Chrome zero-day, and active attacks on Barracuda Email Security Gateways.
Patch now
| Product | Issue | Action |
|---|---|---|
| Microsoft Outlook | CVE-2026-124194, exploited | Install November Office updates |
| SonicWall SonicOS SSL VPN | CVE-2026-19868, exploited | Upgrade to 7.3.4-7013+ or 8.2.3-8015 |
| Google Chrome | CVE-2026-125350, exploited | Update to 157.0.8103.50 or later |
| Barracuda Email Security Gateway | CVE-2026-116606, CVE-2026-111560, exploited | Confirm patches, lock down admin UI |
| ConnectWise ScreenConnect | CVE-2026-84869, active campaign | Patch, remove third-party extensions |
Microsoft Outlook zero-day (CVE-2026-124194)
What it is: An attacker sends a crafted message file. When the user opens it, Outlook connects to an attacker-controlled server without showing the usual external-content warning, which leaks the user’s NTLMv2 hash. That hash can be used to authenticate as the user. Microsoft rates it CVSS 6.5 and marks it as exploited. The Preview Pane is not an attack vector, so the risk is someone opening the file.
Who is affected: Microsoft 365 Apps for Enterprise, Office LTSC 2021, and Office LTSC 2024.
What to do:
- Office LTSC 2021: update to build 16.0.14334.21048 or later.
- Office LTSC 2024: update to build 16.0.17932.21140 or later.
- Microsoft 365 Apps: Microsoft points to its Office security release notes rather than a single build. In Outlook, go to File, Office Account, Update Options, Update Now, and confirm the update channel is not paused.
- General hardening for this class of bug: block outbound SMB (TCP 445) to the internet at your firewall. Most offices have no business reason to allow it.
Source: Microsoft Security Response Center.
Also in the November release: CVE-2026-85844 (Windows Kerberos, CVSS 9.8) lets an unauthenticated attacker relay Kerberos authentication to a domain controller and gain SYSTEM, and CVE-2026-119958 is a CVSS 9.8 remote code execution bug in Windows LDAP. Neither is marked exploited, but if you run an on-premises domain controller, patch it this week. Exchange Server gets a fix for CVE-2026-118207 (CVSS 8.8, rated “Exploitation More Likely”), published only for Exchange Server Subscription Edition (build 15.02.2562.057).
SonicWall SSL VPN MFA bypass (CVE-2026-19868)
What it is: On SonicOS SSL VPN with SAML enabled, a user with valid credentials for another authentication method can bypass SAML login and any MFA enforced through SAML. CISA added it to the KEV list on November 6. SonicWall says it investigated a report of potential exploitation and has not published indicators of compromise. There is no workaround.
Who is affected: Gen7 and Gen8 firewalls running SonicOS 7.3.3-7015 and older or 8.2.2-8015 and older. Gen6 is not listed, but it is already end of support.
What to do: Upgrade to 7.3.4-7013 or later, or 8.2.3-8015. Then compare recent SSL VPN logins against your identity provider’s sign-in logs and reset passwords for any VPN session with no matching MFA event. If you are still on Gen6 hardware, plan the replacement now.
Sources: SonicWall PSIRT, Help Net Security.
Google Chrome zero-day (CVE-2026-125350)
What it is: A use-after-free bug in Chrome’s XML component that lets a malicious web page run code inside the browser sandbox. Google says an exploit exists in the wild, and CISA added it to KEV on November 10.
What to do: Update to Chrome 157.0.8103.50/.51 on Windows and Mac (157.0.8103.50 on Linux) and relaunch the browser. CISA notes that other Chromium-based browsers such as Edge may also be affected, so keep Edge on automatic updates and apply its next release promptly.
Source: Chrome Releases.
Barracuda Email Security Gateway (CVE-2026-116606, CVE-2026-111560)
What it is: Two flaws that chain into root access on the appliance. CVE-2026-116606 is a pre-authentication authorization bypass that requires the admin interface to be reachable. CVE-2026-111560 is a command injection. On November 9, Barracuda updated its advisory to say exploitation has hit a small number of organizations.
What to do: Confirm the ESG has patch BNSF-40425 (firmware 9.4.017 and later) or BNSF-40430 (older firmware). Turn automatic patching back on if someone disabled it. Restrict the admin interface to trusted internal networks. CVE-2026-111560 also affects Barracuda ADC/WAF, Message Archiver, WAF Control Center, and Web Security Gateway, each with its own patch listed in the advisory.
Source: Barracuda Trust Center.
ConnectWise ScreenConnect session hijacking
What it is: Researchers recovered an attacker toolkit aimed at ScreenConnect that exploits CVE-2026-84869 (CVSS 9.9), a flaw already in the KEV list since September, and can also hijack authenticated technician sessions to push malicious code. ConnectWise disabled several third-party extensions, including RMM+, and told on-premises partners to disable them. Huntress found that RMM+ versions 1.0.31 and 1.0.32 accepted a blank access key when none was configured.
What to do: This matters if you or your IT provider uses ScreenConnect. Confirm the server and clients are fully patched (Blackpoint reports the existing patch blocks the known exploit), remove RMM+ and similar third-party extensions, rotate technician credentials, and look for ScreenConnect Access installs you do not recognize.
Source: The Hacker News.
Other items this week
Gemini in Gmail turns on for all adult Workspace users
What it means: Starting November 10, Google is rolling out AI Overview thread summaries and non-personalized “Help me write” in Gmail to all Workspace users 18 and older who have smart features enabled. Both are on by default, with a gradual rollout of up to 15 days. If your business has not decided how staff may use AI with client email, this makes the decision for you.
What to do: Decide whether these features fit your data handling rules. Admins can disable Gemini features in Gmail from the Admin console, and users can turn them off individually. Write the decision into your acceptable use policy so it does not drift.
Source: Google Workspace Updates.
This week’s checklist
- Confirm the November Windows and Office updates are installed on every PC and server, starting with domain controllers. Spot check Outlook builds against the versions above.
- Verify your firewall blocks outbound TCP 445 to the internet.
- Log in to each SonicWall and confirm the firmware is 7.3.4-7013 or later, or 8.2.3-8015. Review SSL VPN logins since early November.
- Check chrome://settings/help on a sample of machines and confirm 157.0.8103.50 or later.
- If you run a Barracuda ESG or ScreenConnect, confirm the patches above and that neither admin interface is open to the internet.
- Decide on Gemini in Gmail: leave it on, or disable it in the Admin console, and document the choice.
None of these fixes are hard, but they only work if every machine actually gets them and someone checks. If patching and verification keep slipping, our managed IT services cover patching, monitoring, and vendor management with a senior engineer you work with directly. For firewall and VPN hardening, see network infrastructure, and for MFA and email security, see cybersecurity services.
