19 reportsPriority High
Microsoft and Barracuda vulnerability disclosures
Multiple vulnerabilities have been disclosed in Microsoft and Barracuda products, with some reported as actively exploited. UK organisations should assess their exposure to these issues.
First report Latest
What is going on
- CISA added two vulnerabilities in Ivanti Connect Secure to its known-exploited catalogue based on evidence of active exploitation.
- Microsoft published 1,092 vulnerabilities in November 2026 Patch Tuesday, including 1,102 in Windows, with some reported as exploited in the wild.
- Barracuda Networks disclosed an authentication bypass vulnerability in its Email Security Gateway that could allow unauthenticated remote access, with reports of exploitation in the wild.
- What to watch: Confirm whether affected software is present in your estate and apply patches promptly.
Reports in this story
Newest first. Each one is a separate event with its own sources and evidence.
- Priority LowType Research & news
Dreeze Emerges From Stealth With $33M to Rebuild Cloud Apps After Cyberattacks
- Priority LowType Research & news
Microsoft fixes audio issues caused by September security updates
- Priority LowType Research & news
Microsoft fixes Exchange sign-ins broken by Windows Server updates
- Priority HighType VulnerabilityLead report
Ivanti Connect Secure Missing Authentication Vulnerability
- Priority LowType Research & news
Exchange for breakfast: Turla’s Cereal tricks are not for kids
- Priority LowType Research & news
Microsoft releases Windows 10 KB5131096 extended security update
- Priority LowType Vulnerability
Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information over a network
- Priority LowType Vulnerability
Stack-based buffer overflow in Microsoft Graphics Component allows an authorized attacker to elevate privileges locally
- Priority LowType Vulnerability
Missing authorization in Microsoft Office SharePoint allows an authorized attacker to execute code over a network
- Priority LowType Vulnerability
Missing authorization in Microsoft Windows Search Component allows an authorized attacker to perform tampering locally
- Priority LowType Vulnerability
Microsoft Fixes Nearly 1,100 Security Vulnerabilities
- Priority MediumType Vulnerability
Barracuda Networks Email Security Gateway (ESG) Authentication Bypass Using an Alternate Path or Channel Vulnerability
- Priority LowType Vulnerability
Server-side Request Forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network
- Priority LowType Vulnerability
Double free in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network
- Priority LowType Vulnerability
Heap-based buffer overflow in Microsoft Internet Messaging API allows an authorized attacker to execute code locally
- Priority LowType Vulnerability
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network
- Priority LowType Vulnerability
Integer overflow or wraparound in Windows PowerShell allows an authorized attacker to execute code locally
- Priority LowType Vulnerability
Weak authentication in Microsoft PowerToys allows an authorized attacker to perform tampering locally
- Priority HighType Vulnerability
Microsoft Office Outlook Missing User Interaction for Potentially Unsafe Action Vulnerability