{"id":4154,"date":"2026-11-11T06:48:45","date_gmt":"2026-11-11T14:48:45","guid":{"rendered":"https:\/\/cyber.mag212.com\/mag212-cyber-daily-2026-11-11-barracuda-outlook-xen-orchestra-fortinet\/"},"modified":"2026-11-11T07:10:01","modified_gmt":"2026-11-11T15:10:01","slug":"mag212-cyber-daily-2026-11-11-barracuda-outlook-xen-orchestra-fortinet","status":"publish","type":"post","link":"https:\/\/cyber.mag212.com\/fr\/mag212-cyber-daily-2026-11-11-barracuda-outlook-xen-orchestra-fortinet\/","title":{"rendered":"MAG212 CYBER Daily, 11 November 2026: Barracuda exploited, Outlook zero-day, Xen Orchestra takeover, Fortinet criticals"},"content":{"rendered":"\n
\n
Download the PDF (18 pages)<\/a><\/div>\n<\/div>\n\n\n\n

Happy Veterans Day, and thank you to everyone who has served.<\/strong><\/p>\n\n\n\n

MAG212 CYBER \u00b7 Daily Cyber Intelligence \u00b7 Wednesday, November 11, 2026 \u00b7 Research cutoff 06:00 PT.<\/strong> Today the way in is the admin console. An exploited Barracuda flaw chain gives root on six appliance lines, and CISA gave agencies until November 13 to fix it and look for compromise. Microsoft’s only exploited bug among about 1,094 CVEs this month is an Outlook hash leak. A Xen Orchestra authentication bypass hands over whole XCP-ng pools. Management planes that answer from the internet are being found and used.<\/p>\n\n\n\n

What needs attention today<\/h2>\n\n\n\n
#<\/th>Action<\/th>How<\/th><\/tr><\/thead>
1<\/td>Barracuda: lock down admin UIs, patch, and triage before 13 Nov<\/strong><\/td>Restrict admin interfaces to trusted networks, confirm each product’s patch ID (ESG BNSF-40425\/-40430, ADC\/WAF BNADC-16586, BMA BNMA-32468, WCC BNWF-60060, WSG BNYF-24789) and review config-import\/restore history on exposed devices.<\/td><\/tr>
2<\/td>Xen Orchestra: isolate, upgrade to 6.9.2 \/ 6.10.1, run Vates’ host checks<\/strong><\/td>Block the eight published IPs and the onion C2. Any IOC hit means rotating every secret and reinstalling.<\/td><\/tr>
3<\/td>Microsoft and Chrome: Office fix, Exchange and DCs first, Chrome 157<\/strong><\/td>Ship the November Office update (CVE-2026-124194); put Exchange servers and DCs in the first ring (CVE-2026-116928, -119958); force Chrome 157.0.8103.50\/.51.<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

What\u2019s inside<\/h2>\n\n\n\n