BroadWorks and Webtop flaws expose messaging systems
CISA added two actively exploited flaws in Cisco BroadWorks and Openwave Messaging Webtop to its Known Exploited Vulnerabilities catalog on Nov. 10, extending a November update that already included Microsoft’s actively exploited Outlook flaw. SecurityWeek reports that Malbear Labs linked BroadWorks exploitation to a campaign targeting a European telecom provider and at least 13 organizations using its services.
In BroadWorks, a remote attacker can send crafted XML without logging in and read sensitive configuration. In Webtop, an authenticated user can bypass the webmail flow to convert unintended document types. Outlook’s separate flaw requires someone to open a crafted message file; it can make Outlook contact an attacker’s network resource and reveal the user’s NTLMv2 authentication hash. Microsoft says the Preview Pane alone cannot trigger it, and a fix cannot retract a hash already exposed.
For telecom operators, the BroadWorks and Webtop flaws create distinct service-platform risks beyond Outlook. If a provider’s systems hold subscriber, billing, or device records, customers may inherit exposure through that provider; the reported campaign is tied to one European provider and its users.
CVSS 7.5 HIGH: a vulnerability in the Open Client Interface (OCI) XML Parser of Cisco BroadWorks could allow an unauthenticated… EPSS 0.8% (58th percentile).
CVSS 4.3 MEDIUM: openwave Webtop Media Transcoder does not enforce administrator-defined file type restrictions to restrict the file-types to be converted. EPSS 0.6% (51st percentile), up from 0.3%.
CVSS 6.5 MEDIUM: product ui does not warn user of unsafe actions in Microsoft Office Outlook allows an unauthorized attacker to… Microsoft patch: Release Notes.
Microsoft FORGE Lab researchers used codename MDASH to investigate Linux kernel vulnerabilities, resulting in 59 upstream bug reports, 33 assigned CVEs, and 38 merged fixes.
JPCERT-AT-2026-0035 JPCERT/CC 2026-11-11 Microsoft Corporation November 2026 Security Updates https://msrc.microsoft.com/update-guide/releaseNote/2026-Nov According to Microsoft, among the vulnerabilities, the following vulnerability has been confirmed to be exploited in the…
Microsoft did another four-digit patch drop today, releasing updates to fix almost 1,100 security vulnerabilities in its Windows operating systems and supported software.