Morning Threat Brief: Microsoft patches an exploited Outlook zero-day in a record Patch Tuesday, Barracuda flaws chain to root with a Friday deadline, SAP patches four perfect 10s, and Vanderbilt's attacker claims a million SSNs

Good morning. Microsoft's November Patch Tuesday fixes 1,235 flaws, including an Outlook zero-day attackers are already using to steal Windows login hashes. Two Barracuda email security flaws chain together to give attackers root on the appliance, and the fix is due Friday. SAP patched four flaws with perfect 10 scores, all exploitable without logging in. And the ransomware group behind the Vanderbilt attack claims it stole more than a million Social Security numbers, a claim nobody has verified. Patch Outlook today, and check your Barracuda boxes before Friday.

1. Microsoft patches an exploited Outlook zero-day that steals your Windows login. Microsoft's November Patch Tuesday fixes 1,235 flaws, 66 of them critical, and the one that matters most is already being exploited. CVE-2026-124194 is a spoofing flaw in Outlook: open a specially crafted message file and Outlook connects to an attacker-controlled server without its usual warning, handing over your NTLMv2 login hash, which the attacker can crack offline or relay to sign in as you. The Preview Pane is not an attack vector, so the file has to be opened, which usually means a phishing email with an attachment. It affects Microsoft 365 Apps for Enterprise and Office LTSC 2021 and 2024. Microsoft rates it Moderate at 6.5, which is the point: the score measures the bug, not the fact that attackers are already using it. The release also includes a critical pre-authentication remote code execution flaw in Windows Schannel, CVE-2026-119952. Install the November updates now, starting with Outlook, and treat unexpected message files the way you treat unexpected links: do not open them.

2. Two Barracuda flaws chain to root, and the fix is due Friday. CISA added two Barracuda vulnerabilities to its exploited list on November 10, both with a federal deadline of Friday, November 13. CVE-2026-116606, scored 9.3, is a pre-authentication authorization bypass in the Email Security Gateway: an attacker who can reach the admin interface can restore a crafted backup and rewrite the appliance's global configuration, no login needed. CVE-2026-111560, scored 8.6, is an operating system command injection in the timezone field that runs commands as root. Used together, Barracuda says, they can hand an attacker root on the device. Barracuda confirmed on November 9 that exploitation is hitting a small number of organizations. The bypass affects Email Security Gateway versions before 9.4.0.030; the injection flaw also hits the Load Balancer, Message Archiver, Web Application Firewall, WAF Control Center, and Web Security Gateway. Apply the Barracuda patches now, keep the admin interface off the public internet, and if that page was ever reachable, do a forensic review for unexpected configuration changes, backup restores, or timezone changes, because patching does not undo an attacker who is already in.

3. SAP patches four flaws with perfect 10 scores, and one is broken by default. SAP's November Patch Day fixed 38 issues, and four of them carry the maximum CVSS score of 10.0, all exploitable by an unauthenticated attacker over the network with no user action. CVE-2026-89103, nicknamed PROXYGATE, is a broken access control default in SAP Gateway that treats an outside attacker as one of the system's own application servers; the shipped configuration is the vulnerable one. CVE-2026-120017 is a SAML assertion bypass that can let an attacker log in as any user. CVE-2026-76964 is a memory corruption flaw in the Internet Communication Manager, and CVE-2026-89126 is a heap overflow in the Web Dispatcher. Both can lead to remote code execution. Onapsis researchers found three of the four. SAP has not reported active exploitation, and none of the four is in CISA's exploited list yet, but SAP NetWeaver flaws have a short trip from patch day to exploitation. If you run SAP, apply the kernel and Web Dispatcher patches now, and check the Gateway proxy list first, since a permissive list leaves the system exposed at any patch level.

4. Vanderbilt's attacker claims a million stolen Social Security numbers. UNVERIFIED. The ransomware group BYOD claimed responsibility on Monday for the cyberattack that hit Vanderbilt University, and its claims have grown louder since. The group says it stole more than a million Social Security numbers plus names, email addresses, phone numbers, and student and employee records, and took control of part of the university's network. Campus computers reportedly played an audio threat attributed to the group. BYOD also claimed an attack on Texas Health and Human Services the same day. Vanderbilt confirmed the incident on Monday and told students and staff to shut down devices and disconnect from campus Wi-Fi. Wi-Fi came back Monday evening, most systems are still restricted, and classes are running on a normal schedule. The university has not confirmed that any records were taken and has not named who is behind the attack. BYOD is a relatively new group that first surfaced in September. If you are at Vanderbilt, watch for unexpected pop-ups, unfamiliar apps, password requests, and files that go missing or change names, and report anything odd to IT from a separate device. For everyone else, the same lesson: verify unexpected requests through a separate channel, and use two-factor authentication on every account that holds your records.

Warning: the VMware ESX flaw CVE-2026-41709 is due today, Wednesday, November 11. Four more exploited flaws from yesterday's brief are due tomorrow, Thursday, November 12, and SANS honeypots are already seeing exploit attempts against the OpenSSH hole. The two Barracuda flaws and the second Ivanti flaw CVE-2026-118527 are due Friday, November 13. The Apple KEV entry CVE-2024-27834 is due November 18, the SonicWall SSL-VPN flaw CVE-2026-19868 is due Friday, November 20, and the four new KEV entries from today, including the Outlook and Chrome zero-days, are due Tuesday, November 24.

Full writeups: kevintswaney.com/vuln-watch
Indicators to hunt: kevintswaney.com/ioc-library

Six new CISA KEV entries today, all added November 10, two due Friday and four due November 24. The catalog stands at 1,779 entries, last updated November 10.

← kevintswaney.com