The past week saw several significant cybersecurity developments, including the active exploitation of vulnerabilities in Microsoft Outlook, Cisco BroadWorks and OpenSSH, as well as new allegations of state-sponsored cyberattacks targeting critical commercial infrastructure. Security agencies also expanded their warnings about vulnerabilities affecting enterprise communications, artificial intelligence platforms and widely deployed software.
Microsoft Outlook Zero-Day Exploited to Steal Authentication Credentials
Microsoft has addressed an actively exploited zero-day vulnerability in Outlook that could allow attackers to obtain sensitive Windows authentication information through maliciously crafted message files.
Tracked as CVE-2026-124194, the vulnerability can expose NTLMv2 authentication data when a victim opens a specially crafted file. The stolen information could potentially be used in subsequent attacks against enterprise systems, depending on the authentication mechanisms and protections deployed within the affected environment.
The vulnerability received a CVSS 3.1 score of 6.5, although its confirmed exploitation makes it particularly relevant for organizations relying on Microsoft Outlook and Windows-integrated authentication.
The US Cybersecurity and Infrastructure Security Agency (CISA) added the flaw to its Known Exploited Vulnerabilities catalog on November 10, confirming that attackers had already begun exploiting it. Organizations have been advised to install the available security updates and review their exposure to NTLM-based authentication attacks.
Cisco BroadWorks Vulnerability Exploited Against Telecommunications Infrastructure
A security vulnerability affecting Cisco BroadWorks, a communications platform widely used by telecommunications operators and managed service providers, has been exploited in attacks targeting service-provider infrastructure.
The vulnerability, tracked as CVE-2026-20320, involves improper handling of XML external entities in the BroadWorks Open Client Interface. An unauthenticated attacker can exploit the flaw by sending specially crafted XML requests, potentially obtaining sensitive configuration files and other information accessible to the affected service.
Security researchers reported an attack involving a European telecommunications provider in which the attackers allegedly used an AI-assisted workflow to exploit the vulnerability. The intrusion reportedly exposed cryptographic keys and authentication materials, raising concerns about the potential compromise of communications infrastructure serving multiple customers.
Cisco released a security fix in August, but exploitation continued against systems that had not been updated. CISA added the vulnerability to its Known Exploited Vulnerabilities catalog on November 10, emphasizing the importance of promptly securing affected deployments.
OpenSSH Authentication Bypass Vulnerability Targeted in Active Attacks
Attackers have begun exploiting a security vulnerability in OpenSSH that could allow unauthorized access to affected Linux systems under certain conditions.
Tracked as CVE-2026-123158 and nicknamed SSHole, the vulnerability involves incorrect handling of an unexpected status or return value during authentication. Successful exploitation can potentially result in an authentication bypass.
Security monitoring organizations observed exploitation attempts beginning in early November, with attackers conducting system reconnaissance, attempting to access sensitive authentication files and establishing persistent access through SSH configuration changes.
Some observed attacks involved cryptocurrency-mining activity and the deployment of a Python-based command-and-control agent capable of executing commands, transferring files and collecting system information.
CISA added the vulnerability to its Known Exploited Vulnerabilities catalog on November 9. Administrators operating affected OpenSSH installations have been urged to apply the available fixes and examine authentication logs for suspicious activity.
France Accuses Iran of Cyberattack Against Supermarket Refrigeration Systems
French authorities have accused a cyber unit linked to Iran's Islamic Revolutionary Guard Corps of conducting a disruptive attack against supermarket refrigeration infrastructure.
The incident, which occurred in October but became the subject of a major public attribution announcement this week, reportedly affected refrigeration equipment at approximately 700 supermarkets across France. Attackers remotely manipulated temperature controls, causing refrigeration units to reach temperatures unsuitable for storing food.
The disruption lasted approximately six hours and forced affected retailers to discard substantial quantities of refrigerated and frozen products. Reported financial losses reached tens of millions of euros.
French authorities attributed the operation to an Iranian-linked cyber unit and announced an investigation into suspected organized cybercrime conducted in the interests of a foreign power. France also indicated that it would seek European sanctions against individuals believed to be responsible.
The incident highlights the potential consequences of attacks against operational technology and remotely managed industrial systems, where unauthorized digital access can cause immediate physical and financial damage.