(TLP:CLEAR) Weekly Vulnerabilities to Prioritize – November 12, 2026

The below vulnerabilities have been identified by WaterISAC analysts as important for water and wastewater utilities to prioritize in their vulnerability management efforts. WaterISAC shares critical vulnerabilities that affect widely used products and may be under active exploitation. WaterISAC draws additional awareness in alerts and advisories when vulnerabilities are confirmed to be impacting, or have a high likelihood of impacting, water and wastewater utilities. Members are encouraged to regularly review these vulnerabilities, many of which are often included in CISA’s Known Exploited Vulnerabilities (KEV) Catalog.

SonicWall Firewalls Exploited in the Wild

See WaterISAC’s notification regarding this vulnerability

Multiple Vulnerabilities in Fortinet Products Could Allow for Arbitrary Code Execution

Description: Multiple vulnerabilities have been discovered in Fortinet FortiOS, FortiManager, FortiAnalyzer, and other Fortinet products, the most severe of which could allow for arbitrary code execution. Successful exploitation of the most severe of these vulnerabilities could result in arbitrary code execution. Depending on the privileges associated with the account, an attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Accounts configured to have fewer user rights on the system could be less impacted than those that operate with administrative user rights.
Source: https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-fortinet-products-could-allow-for-arbitrary-code-execution_2026-133

Barracuda Email Security Gateway

CVSS v3.1: 9.3, 8.6
CVEs: CVE-2026-116606, CVE-2026-111560
Description: Barracuda has identified two vulnerabilities affecting certain Barracuda products: a pre-authentication authorization bypass vulnerability and a command injection vulnerability. The vulnerabilities have been assigned CVE-2026-116606 and CVE-2026-111560, respectively.
Source: https://trust.barracuda.com/security/pre-authentication-authorization-bypass-command-injection

Zero Day in Microsoft Outlook, Spoofing Vulnerability

CVSS v3.1: 6.5
CVEs: CVE-2026-97229
Description: Product ui does not warn user of unsafe actions in Microsoft Office Outlook allows an unauthorized attacker to perform spoofing over a network.
Source: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-124194

Google Chrome/Chromium: High-severity use-after-free

CVSS v3.1: N/A
CVEs: CVE-2026-110264
Description: Use after free in XML in Google Chrome prior to 157.0.8103.50 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Source: https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_018223192.html

Zero Day in Zyxel GS1900 Switches

CVSS v3.1: 8.8
CVEs: CVE-2026-107441
Description: An out-of-bounds write vulnerability in the CGI program of Zyxel GS1900-24E firmware versions through 2.90(AAHK.2)C0 could allow an unauthenticated adjacent attacker to exploit the flaw and potentially execute OS commands via a crafted HTTP request.
Sources: https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-out-of-bounds-write-vulnerability-in-gs1900-series-switches-11-03-2026