CISA KEV速報 — 2026-11-10に6件追加

CISA（米サイバーセキュリティ・インフラセキュリティ庁）のKnown Exploited Vulnerabilities（KEV）カタログに、2026-11-10付けで6件のCVEが新規追加された。KEVは実際の悪用が確認された脆弱性のみを掲載するリストであり、追加された時点で攻撃者による悪用が現に進行している可能性が高い。

CVE-2026-20320 — Cisco BroadWorks

脆弱性名: Cisco BroadWorks Improper Restriction of XML External Entity Reference Vulnerability

Cisco BroadWorks contains an improper restriction of XML external entity reference vulnerability that could allow an unauthenticated, remote attacker to read sensitive configuration information on an affected system.

CVE-2026-116606 — Barracuda Networks Barracuda Email Security Gateway (ESG)

脆弱性名: Barracuda Networks Email Security Gateway (ESG) Authentication Bypass Using an Alternate Path or Channel Vulnerability

Barracuda Networks Email Security Gateway (ESG) contains an authentication bypass using an alternate path or channel that could allow an unauthenticated remote attacker to invoke a configuration-import function and restore a crafted, compatible backup archive, resulting in unauthorized modification of the appliance’s global configuration. This vulnerability can be chained with CVE-2026-111560.

CVE-2026-111560 — Barracuda Networks Multiple Products

脆弱性名: Barracuda Networks Multiple Products OS Command Injection Vulnerability

Barracuda Networks Email Security Gateway (ESG), Load Balancer, Application Delivery Controller (ADC), Message Archiver (BMA), WAF Control Center (WCC), Web Application Firewall (WAF), and Web Security Gateway (WSG) contain an OS command injection vulnerability. This vulnerability could allow an authenticated administrator to inject OS commands that execute with root privileges when the crafted timezone value is subsequently processed. This vulnerability can be chained with CVE-2026-116606

CVE-2026-124194 — Microsoft Office

脆弱性名: CVE-2026-124194

Product ui does not warn user of unsafe actions in Microsoft Office Outlook allows an unauthorized attacker to perform spoofing over a network.

CVE-2026-111793 — Openwave Messaging Limited Webtop Media Transcoder

脆弱性名: Openwave Messaging Limited Webtop Media Transcoder Incorrect Resource Transfer Between Spheres Vulnerability

Openwave Messaging Limited Webtop Media Transcoder contains an incorrect resource transfer between spheres vulnerability that may allow an authenticated user to process and convert unintended document types if bypassing the Webmail experience.

CVE-2026-125350 — Google Chromium

脆弱性名: CVE-2026-125350

Use after free in XML in Google Chrome prior to 157.0.8103.50 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

※本記事はCISA KEVの公開データをもとに機械的に生成している。対応要否は各組織の環境に応じて判断すること。