CISA adds six actively exploited vulnerabilities to KEV catalogue
CISA has added six vulnerabilities affecting Cisco, Barracuda, Openwave, Microsoft and Google to its Known Exploited Vulnerabilities catalogue.
The US Cybersecurity and Infrastructure Security Agency has added six actively exploited vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, telling organisations to prioritise remediation of the newly listed flaws.1
The entries affect products and services from Cisco, Barracuda Networks, Openwave Messaging, Microsoft and Google. The listed vulnerabilities are CVE-2026-20320 in Cisco BroadWorks; CVE-2026-111560 in multiple Barracuda products; CVE-2026-111793 in Openwave Messaging Limited Webtop; CVE-2026-116606 in Barracuda Email Security Gateway; CVE-2026-124194 in Microsoft Office Outlook; and CVE-2026-125350 in Google Chromium.1
What CISA is warning about
The KEV Catalog is CISA’s public record of vulnerabilities for which there is evidence of active exploitation. Its additions are intended to help defenders prioritise work that carries a more immediate risk than an ordinary, unexploited software flaw.
CISA says the six vulnerabilities pose significant risks to the federal enterprise. Its binding operational directive applies to US federal civilian agencies, which must follow the required remediation timetable. Private companies, local authorities and organisations outside the US are not directly bound by that directive, but the catalogue remains a useful signal that the affected products deserve urgent investigation rather than being left in a routine patch queue.1
The alert does not provide a single technical explanation of how each vulnerability is being exploited, nor does it list every affected product version. Administrators should therefore check the relevant Cisco, Barracuda, Openwave, Microsoft and Google advisories before deciding whether a system is exposed. Applying a fix is only one part of the response: teams should also review logs, access records and endpoint telemetry for signs that a vulnerable service has already been targeted.
Why the list matters
CISA’s catalogue is deliberately focused on exploitation evidence, not on ranking every newly disclosed CVE. Six additions in one alert do not mean all six flaws have the same severity or impact, and the catalogue entry alone is not a substitute for a vendor’s technical advisory. It does mean defenders have a clear reason to move these items ahead of lower-risk maintenance.
For UK and EU organisations, the US directive is not a legal instruction. The practical takeaway is still relevant: if any of the named products are exposed to the internet or used to protect sensitive services, security teams should confirm the affected versions, apply the vendor fix where available, and look for evidence of compromise.
Our opinion
A KEV entry is most useful when it changes the order of work. Organisations should not treat CISA’s alert as a complete incident report, but they should treat it as a strong prioritisation signal. The missing exploit detail makes vendor advisories and local telemetry essential; it does not make the six additions safe to defer.