// Deep technical intelligence on the highest-severity known-exploited vulnerabilities
We cover only Critical and High-severity vulnerabilities from the CISA Known Exploited Vulnerabilities catalogue — confirmed active threats with CVSS 7.0 or above. Each analysis breaks down the exploit mechanism, real-world attack campaigns, and concrete remediation steps so your team can act fast.
Barracuda Networks — Email Security Gateway (ESG) and other Barracuda appliances
Two Barracuda flaws chain an authentication bypass in the Email Security Gateway with a root command injection affecting six appliance products. Barracuda reports exploitation against a small number of organizations, public exploit details exist, and CISA added both to KEV with a 13 November deadline.
Cisco — BroadWorks
An XML external entity flaw in the OCI-P parser of Cisco BroadWorks lets an unauthenticated remote attacker read files with the BroadWorks user's privileges. Malbear Labs reports it was the entry point in an intrusion into a European telecom, and CISA added it to KEV on 10 November 2026. Fixed in RI.2026.07.
GPUStack — GPUStack
GPUStack before 2.2.0 treats any request that appears to come from 127.0.0.1 as the built-in administrator. Behind a same-host reverse proxy, or with a forged X-GPUStack-Real-IP header, remote attackers get full admin access. Exploited in the wild; CISA KEV due 12 Nov 2026.
SignalWire — FreeSWITCH
FreeSWITCH before 1.11.3 lets an inbound SIP MESSAGE select the api chat protocol and run FreeSWITCH API commands, including OS command execution. Default configuration is exposed and exploitation has been observed. CISA KEV due 12 Nov 2026.
OpenBSD — OpenSSH
OpenSSH before 10.6p2 on Linux built with musl libc and without PAM lets a password of 256-1024 characters succeed for some accounts. Alpine Linux is the named example. On CISA KEV, due 12 Nov 2026; fixed in 10.6p2.
IBM — Aspera Faspex
IBM Aspera Faspex 5.0.0 through 5.0.19 lets a crafted message bypass user authorization and gain full administrative privileges. IBM scores it 9.8 and ships 5.0.19 PL1; no workaround. On CISA KEV, due 12 Nov 2026.
Vuln Brief provides authoritative technical analysis of Critical and High-severity vulnerabilities from the CISA Known Exploited Vulnerabilities (KEV) catalogue — the definitive list of CVEs actively exploited in the wild.
We focus exclusively on CVSS 7.0+ entries — the vulnerabilities that represent the highest real-world risk to organisations. Each article goes beyond the NVD description, examining the exploit mechanism, affected code paths, real-world attack campaigns, and concrete remediation steps.
Coverage spans high-priority targets: enterprise network infrastructure, endpoint management, cloud-adjacent systems, and developer tooling — wherever Critical and High KEVs are actively exploited.
We cover only CVSS 7.0+ entries from the CISA KEV catalogue — confirmed active exploitation, highest real-world risk, no noise from lower-severity entries.
We cover exploit mechanisms, vulnerable code paths, CVSS breakdowns, and detection indicators — not just vendor advisories.
Every article includes patch guidance, version ranges, and interim mitigations for when immediate patching isn't possible.