ICHI Briefs & Podcasts · ICHI Daily · five-minute podcast

ICHI Global Five Minute Cyber Rundown

ICHI Daily · Published November 11, 2026 · 5 min listen

Akari's Wednesday briefing: Microsoft Patch Tuesday fixes over a thousand flaws with one exploited Outlook zero-day that leaks NTLMv2 hashes, Barracuda email gateways are now exploited for root access, and Cisco BroadWorks was used in an AI-agent telecom campaign.

Listen to this episode

MP3, 5.1 MB · · the full transcript is below.

Show notes

ICHI Global Five Minute Cyber Rundown — Wednesday, November 11, 2026

Today's theme is prioritization under volume: Microsoft fixed more than a thousand flaws with only one confirmed exploited, a patched email gateway chain is now under real attack, and researchers describe a telecom intrusion run largely by an AI agent.

Most important development — Microsoft Patch Tuesday: exploited Outlook zero-day CVE-2026-124194

Microsoft released its November 2026 Patch Tuesday updates on Tuesday, November 10. The Hacker News counts 1,259 vulnerabilities in total, including 165 non-Microsoft CVE identifiers — the second consecutive month above 1,000. Other counters (Tenable/Ivanti) count 1,093 Microsoft CVEs; the difference is counting method.

Only one flaw is flagged actively exploited:

Microsoft Outlook — CVE-2026-124194 (CVSS 6.5, Moderate): a spoofing flaw (CWE-356, product UI does not warn of unsafe actions). Opening a specially crafted message file can make Outlook connect to an attacker-controlled network location without the usual external-content warning, disclosing the user's NTLMv2 hash, which could be used to impersonate the user. Preview Pane is not an attack vector — the file must be opened. Microsoft marks it Exploitation Detected, not publicly disclosed before the fix, and has not named attackers or attack details. Credited to researcher "nono" and Benoît Sevens (using Claude). Affects Microsoft 365 Apps for Enterprise, Office LTSC 2021 and Office LTSC 2024. CISA added it to KEV on November 10, federal deadline November 24, 2026.

Also in Patch Tuesday — critical RCEs not reported exploited

Windows Search — CVE-2026-116928 (CVSS 9.8, Critical): remote code execution reached through Exchange Server when a crafted attachment is indexed automatically — no user opening required.
Windows LDAP — CVE-2026-119958 (CVSS 9.8, Critical): unauthenticated remote code execution in the LDAP service — particular concern on domain controllers.
Windows Schannel — CVE-2026-119952 and Exchange Server — CVE-2026-118207 (CVSS 8.8, Exploitation More Likely) are also priority fixes in coverage of the release.

Microsoft marks these as not exploited and not publicly disclosed — distinct from the Outlook flaw above.

Email gateway chain now exploited — Barracuda ESG (KEV, deadline November 13)

Barracuda patched two flaws on November 2, 2026; on Monday evening, November 9, it updated its advisory: "We have identified exploitation activity affecting a small number of organizations."

CVE-2026-116606 (CVSS 9.3): pre-authentication authorization bypass in Email Security Gateway (ESG) — an unauthenticated attacker who can reach the Admin UI can modify the appliance's global configuration / restore a crafted configuration backup.
CVE-2026-111560 (CVSS 8.6): OS command injection, also affecting five other Barracuda products (on those, admin access is required).

Chained on ESG, they can bypass authorization and obtain root access. Public proof-of-concept / detection material from watchTowr followed the patches. CISA added both to KEV on November 10 with a November 13, 2026 federal deadline. Patches: BNSF-40425 (ESG 9.4.017+) / BNSF-40430 (older builds); fixed firmware is listed as 9.4.0.029/9.4.0.030 in different summaries — follow Barracuda's advisory for your build. Restrict Admin UI access and check for compromise.

Communications flaws added to KEV — Cisco BroadWorks and Openwave (deadline November 24)

CISA added two flaws on Tuesday, November 10, both due November 24, 2026, citing active exploitation:

Cisco BroadWorks — CVE-2026-20320 (CVSS 7.5): improper restriction of XML external entity (XXE) in the OCI XML Parser — an unauthenticated remote attacker can read sensitive configuration information with BroadWorks user privileges. Fixed August 2026.
Openwave Messaging Webtop Media Transcoder — CVE-2026-111793 (CVSS 4.3): incorrect resource transfer between spheres — an authenticated user bypassing the Webmail experience can process/convert unintended document types and upload a crafted file to obtain sensitive information. Fixed October 2026. Japan Vulnerability Notes said the developer states attacks exploiting it have been observed.

Reported research (not a CISA finding): The Hacker News, citing Malbear Labs, reports CVE-2026-20320 was used in "Operation Snowball" — an unknown Chinese-speaking actor using an autonomous framework built on a jailbroken DeepSeek Flash model against a European telecom provider and 13 companies hosted on its infrastructure, enumerating assets, extracting dozens of credential sets, and exfiltrating thousands of rows of subscriber billing and device records over two weeks, recovering the BroadWorks system identity private key and SSL credential sets from the XSP host, with Sliver, Chisel, and Behinder web shells reported.

Incident — Vanderbilt University (confirmed incident; ransomware claims unconfirmed)

Vanderbilt University confirmed on Monday, November 9 it was "responding to an active cybersecurity incident that may impact university devices, systems, and cloud-based services," telling its community to shut down devices and disconnect from campus WiFi. By Monday evening WiFi was restored with most systems still restricted; by Tuesday evening, November 10, WiFi, Okta, Outlook email, CampusPrint, Brightspace, Zoom, and enrollment services were available while other systems remained restricted. Classes continued.

A group calling itself BYOD has claimed responsibility and extensive theft — "over 1 million SSNs," student/employee records, and domain-controller takeover. Vanderbilt has not confirmed BYOD's claims, attribution, encryption, or data theft. Treat the group's figures as claims only.

Defensive implications

Patch Outlook CVE-2026-124194 first, then the Windows Search and LDAP critical RCEs and Exchange fixes.
Patch Barracuda ESG by November 13 and hunt for root-level compromise; keep Admin UIs off the public internet.
Patch Cisco BroadWorks and Openwave by November 24; review telecom/messaging configuration and credential exposure, especially BroadWorks identity keys if the XXE was reachable.
Prioritize by exploitation status, not by volume or CVSS alone.

ICHI note

No live ICHI composite score is cited in this episode because the live score did not render in the pre-production check at production time. ICHI.global's production methodology remains VECTORS v7.1; no methodology change is announced. Model C scoring refinements remain under development.

SOURCES

The Hacker News — Microsoft Patches 1,259 Flaws, Including Exploited Outlook Bug That May Expose NTLMv2 Hashes: https://thehackernews.com/2026/11/microsoft-patches-1259-flaws-including.html
The Hacker News — Cisco BroadWorks and Openwave Flaws Actively Exploited Despite Available Patches: https://thehackernews.com/2026/11/cisco-broadworks-and-openwave-flaws.html
BleepingComputer — Hackers now exploit critical Barracuda ESG flaws to gain root access: https://www.bleepingcomputer.com/news/security/hackers-exploit-barracuda-email-security-gateway-flaws-to-get-root-access/
Security Affairs — Microsoft November Patch Tuesday: one exploited Outlook bug and 30 wormable flaws: https://securityaffairs.com/202839/hacking/microsoft-november-patch-tuesday-one-exploited-outlook-bug-and-30-wormable-flaws.html
Ivanti — November 2026 Patch Tuesday: https://www.ivanti.com/blog/november-2026-patch-tuesday
The Register — Ransomware threat blares from Vanderbilt University computers during cyberattack: https://www.theregister.com/cyber-crime/2026/11/10/ransomware-threat-blares-from-vanderbilt-university-computers-during-cyberattack/5308687
Inside Higher Ed — Ransomware Gang Says It Hacked Vanderbilt University: https://www.insidehighered.com/news/tech-innovation/administrative-tech/2026/11/11/ransomware-gang-says-it-hacked-vanderbilt

Transcript

Akari: The daily cyber rundown, brought to you by I C H I dot global. I'm Akari, an AI-generated voice. This is Wednesday, November eleventh, twenty twenty-six. Today is a patching day with a twist. Microsoft has fixed more than a thousand flaws and only one is confirmed exploited, an email gateway chain has moved from disclosure to real attacks, and researchers describe an intrusion run largely by an A I agent.

Akari: The most important development is Microsoft's November Patch Tuesday, released on Tuesday. The Hacker News counts one thousand two hundred fifty-nine vulnerabilities in total, including one hundred sixty-five identifiers from other vendors, the second straight month above one thousand. Only one flaw is flagged as actively exploited. It is in Outlook, C V E twenty twenty-six, one two four one nine four, rated moderate at six point five. Opening a crafted message file can make Outlook connect to a server the attacker controls, without the usual external content warning, and disclose the user's N T L M version two hash, which can be used to impersonate that user. The Preview Pane is not an attack vector, the file has to be opened. Microsoft has not named the attackers. C I S A added the flaw to its Known Exploited Vulnerabilities catalog, due November twenty-fourth, for Microsoft three hundred sixty-five Apps and Office L T S C twenty twenty-one and twenty twenty-four.

Akari: Patch Tuesday also carries critical remote code execution flaws that are not reported exploited, and the distinction matters. Windows Search, rated nine point eight, can be reached through Exchange Server when a crafted attachment is indexed automatically, with no one opening anything. Windows L D A P, also nine point eight, is a particular concern on domain controllers. Treat the Outlook fix as first, then these identity critical fixes, ahead of the long tail.

Akari: Next, Barracuda has confirmed exploitation of its Email Security Gateway. Two flaws patched on November second now chain together. The first, C V E twenty twenty-six, one one six six zero six, rated nine point three, is an authorization bypass that lets an unauthenticated attacker who can reach the admin interface change the appliance's global configuration. The second, rated eight point six, is a command injection flaw. Together they can give root access. Barracuda said Monday it has identified exploitation affecting a small number of organizations, and C I S A listed both flaws as exploited, due November thirteenth. Apply the Barracuda patches, keep admin interfaces off the public internet, and check for compromise, not just exposure.

Akari: C I S A also added two communications flaws on Tuesday, both due November twenty-fourth. The Cisco BroadWorks flaw, C V E twenty twenty-six, two zero three two zero, rated seven point five, is an unauthenticated X M L external entity flaw that can read sensitive configuration. The Hacker News, citing Malbear Labs, reports it was used in Operation Snowball, in which an unknown Chinese speaking actor used an autonomous framework built on a jailbroken DeepSeek model against a European telecom provider and thirteen companies on its infrastructure, extracting credentials and thousands of rows of subscriber records over two weeks. That account is reported research, not a C I S A finding. The second flaw, in Openwave Messaging, rated four point three, lets an authenticated user process unintended document types, and Japan's vulnerability notes say attacks have been observed.

Akari: On incidents, Vanderbilt University confirmed on Monday it is responding to an active cybersecurity incident affecting devices, systems, and cloud services, and told its community to shut down devices and disconnect from campus Wi Fi. By Tuesday evening, Wi Fi, email, Zoom, Brightspace, Okta, and enrollment services were available, while most other systems remained restricted, and classes continued. A ransomware group calling itself B Y O D has claimed extensive data theft, including more than one million Social Security numbers. Vanderbilt has not confirmed those claims or any data theft, so treat them as claims only.

Akari: Defensively, then. Patch Outlook first, then the Windows Search and L D A P critical fixes. Patch Barracuda gateways by November thirteenth and hunt for signs of root level compromise. Patch Cisco BroadWorks and Openwave by November twenty-fourth, and review telecom and messaging configuration access. The takeaway is prioritization. Volume is not the risk, exploitation is. For the underlying evidence behind every story today, visit I C H I dot global. I'm Akari. Stay safe, stay frosty, and I will see you tomorrow.

Sources

The Hacker News — Microsoft Patches 1,259 Flaws, Including Exploited Outlook Bug That May Expose NTLMv2 Hashes thehackernews.com
The Hacker News — Cisco BroadWorks and Openwave Flaws Actively Exploited Despite Available Patches thehackernews.com
BleepingComputer — Hackers now exploit critical Barracuda ESG flaws to gain root access www.bleepingcomputer.com
Security Affairs — Microsoft November Patch Tuesday: one exploited Outlook bug and 30 wormable flaws securityaffairs.com
Ivanti — November 2026 Patch Tuesday www.ivanti.com
The Register — Ransomware threat blares from Vanderbilt University computers during cyberattack www.theregister.com
Inside Higher Ed — Ransomware Gang Says It Hacked Vanderbilt University www.insidehighered.com

All ICHI Daily episodes · ICHI Briefs & Podcasts

ICHI Daily and ICHI Weekly are editorial commentary on ICHI’s evidence. They never change the VECTORS score, incident evidence classifications or intelligence rankings.

ICHI Briefs & Podcasts · ICHI Daily · ICHI Weekly · Episode calendar · ICHI Perspectives · episodes.json · ICHI dashboard · Methodology