| Email and Browser Security
Your Inbox Is This Week's Target
On Tuesday CISA added six flaws to its list of vulnerabilities attackers are actively using, and three of them go after the tools your team opens first thing every morning: Outlook, Chrome-based browsers like Chrome and Edge, and Barracuda email security gateways. For the two Barracuda flaws, which attackers chain together to take over the appliance, CISA set a deadline of tomorrow, November 13. Barracuda has posted its advisory and fixes.
Email and the browser are where phishing, fake invoices and malicious links land. Three things to check before the weekend:
Confirm Office and browsers update themselves. Make sure Outlook, Chrome and Edge are set to update automatically on every work device, then spot-check a few to see that they actually did.
Ask who owns the email gateway. If a Barracuda or similar filter sits in front of your email, find out whether you or your IT provider patches it, and get the answer in writing.
Remind your team to slow down. The Outlook flaw is a spoofing flaw, so a message may not be what it seems. A quick reminder to verify unexpected payment or password requests by phone still works.
If you handle patient information, email is one of the first places to look in your risk analysis.
| This Week's CVEs from CISA
CISA added ten flaws to its Known Exploited Vulnerabilities (KEV) catalog on Monday and Tuesday. These are the ones most likely to touch healthcare, energy, trucking and answering services, plus the everyday office stack. Two were due today, so treat those as today's work.
CVE-2026-124194 | Microsoft Office (Outlook). Outlook can carry out a potentially unsafe action without asking the user, which lets an attacker spoof over the network. Patch or apply the vendor mitigation. KEV due date: November 24, 2026.
CVE-2026-125350 | Google Chromium (Chrome, Edge, Opera and other Chromium browsers). A booby-trapped webpage can run code inside the browser's sandbox. Patch or apply the vendor mitigation. KEV due date: November 24, 2026.
CVE-2026-116606 and CVE-2026-111560 | Barracuda Email Security Gateway and other Barracuda appliances. Chained together, an attacker with no login can change the gateway's configuration and then run commands on it as root. Patch or apply the vendor mitigation. KEV due date: November 13, 2026.
CVE-2026-123158 | OpenSSH on Linux. Attackers can get around password sign-in on Linux servers that use SSH. Patch or apply the vendor mitigation. KEV due date: November 12, 2026.
CVE-2026-116779 | SignalWire FreeSWITCH (phone and VoIP platform). An attacker can expose settings and passwords, take control of calls and run commands on the phone system. Patch or apply the vendor mitigation. KEV due date: November 12, 2026.
CVE-2026-20320 | Cisco BroadWorks (hosted phone platform). An attacker with no login can read sensitive configuration from the system. If your phone service runs on BroadWorks, ask your provider whether it's patched. Patch or apply the vendor mitigation. KEV due date: November 24, 2026.
Why it matters for HIPAA: your risk analysis should name the email, browser and phone systems that handle patient information, and your patch management records should show each fix and when it went in.
| Framework Spotlight
SOC 2: Not Every Report Holds Up
A SOC 2 report is only as strong as the audit behind it. This year the AICPA, which sets the standards for SOC 2, has been tightening peer review of firms that turn out SOC 2 reports at high volume, and it has warned about engagements with identical reports, risk assessments and testing from one client to the next.
That matters whether you're getting a report or reading one from a vendor:
Check the auditor. A SOC 2 is issued by an independent, licensed CPA firm. Ask about their peer review and how they tailor testing to your business.
Read past the opinion. Look at the period covered, any exceptions the auditor found, and the controls the vendor expects you to run on your side.
Don't buy speed. A report that skips real testing can fall apart the first time a customer reads it closely.
The AICPA keeps its SOC 2 resources on its SOC page.
| ChatGPT Business Launched
When someone asks ChatGPT about a business like yours, the answer can now draw on details you control. In this guide, you’ll claim your business in ChatGPT Business Hub, verify it, fix what ChatGPT shows, and see how people find you.
Step-by-step:
Open Business Hub from the ChatGPT sidebar and search for your business. For now, local stores and restaurants can only claim an existing US listing
Prove it’s yours with a code sent to the business phone or email, a DNS record on your domain, or your Shopify store. Use whichever option you’re shown
Complete Persona’s ID check with your government ID and registration details. Edits, insights, and the blue check all wait on Persona’s approval
Update your description, contact, and policies. OpenAI reviews each change before it appears, and ChatGPT may also use your website, so keep it current
Open Insights to see mentions, views, and clicks. Eligible US online businesses can also build a business agent; test it in the preview before publishing
Pro tip: Persona checks your details against official records. Copy your legal name, address, and registration number into a note and paste from there. Typing from memory is how an old address slips in.
New on the podcast: In "Compliance, Elevated: The Next Chapter of VanRein", we talk through what clearer communication and a smoother audit look like for your team.
AI risk tools: Start with the AI Exposure Score to see where AI use could be exposing your data, then see how our Secure AI adoption and Managed AI agents services put guardrails around the AI tools and agents your team uses.
We Can Help
Not sure who patches your email gateway, or whether your team would spot a spoofed message? We'll help you sort out who owns what, train your people and write it into your risk analysis. Reply to this email or book a time below.
Thanks for reading, and for trusting us with your compliance.
Rob and Dawn Van Buskirk
Co-founders, VanRein Compliance
Compliance, Elevated.
