CISA Adds Two Barracuda Networks Flaws to KEV Catalog, Patch Now

CISA added two Barracuda Networks vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog on November 10, 2026, and set a patch deadline of November 13, 2026 for federal civilian agencies. The pair — CVE-2026-111560, an OS command injection flaw (CVSS 8.6) that hits six different Barracuda product lines, and CVE-2026-116606, an authentication-bypass flaw specific to Barracuda's Email Security Gateway (CVSS 9.3) — were disclosed by Barracuda on November 2, 2026. CISA's own catalog entries warn that the two bugs "can be chained," meaning an attacker who combines them could land root access on an affected appliance. If you run any of the affected Barracuda products, the short version is: patch today, not next sprint.

Why a Barracuda KEV Entry Matters

Barracuda Networks makes security and networking appliances that sit at the edge of a network — email gateways, web application firewalls, load balancers, and archiving systems — the kind of hardware that is deliberately exposed to untrusted traffic because that is its job. Email Security Gateway, the product most affected here, filters inbound and outbound mail for thousands of organizations, which means a compromised ESG can see, and potentially manipulate, an organization's entire mail flow. That exposure profile is exactly why edge security appliances from vendors like Barracuda, Ivanti, SonicWall, and Fortinet have made up a disproportionate share of KEV catalog additions over the past several years: they are internet-facing by design, they often run outdated embedded Linux stacks, and a single flaw in one can affect dozens of product SKUs that share underlying code, as is the case with CVE-2026-111560's timezone-handling bug.

What CISA Added, and When

On November 10, 2026, the Cybersecurity and Infrastructure Security Agency added two Barracuda Networks CVEs to its Known Exploited Vulnerabilities catalog: CVE-2026-111560 ("Barracuda Networks Multiple Products OS Command Injection Vulnerability") and CVE-2026-116606 ("Barracuda Networks Email Security Gateway (ESG) Authentication Bypass Using an Alternate Path or Channel Vulnerability"). Both entries carry the same dates in CISA's KEV JSON feed: dateAdded of 2026-11-10 and a dueDate of 2026-11-13. CISA's required action for both is to apply vendor mitigations in line with Binding Operational Directive 26-04, complete any forensic triage CISA specifies, and evaluate each asset's internet exposure; where no mitigation exists, agencies are told to follow BOD 26-04's cloud guidance or stop using the product.

A three-day window between addition and due date is short, even by KEV standards, and it reflects how CISA treats vulnerabilities that are already confirmed as exploited: the catalog exists specifically to flag bugs with evidence of active exploitation, not just theoretical risk, so entries tied to live attacks get compressed deadlines. The requirement legally binds only U.S. federal civilian executive branch agencies, but CISA has long urged every organization, public or private, to treat KEV entries as a prioritized patch list.

CVE-2026-111560: Command Injection in the Timezone Setting

CVE-2026-111560 is an OS command injection vulnerability (CWE-78) in the timezone-configuration setting shared across several Barracuda product families. According to Barracuda's advisory, an administrator account that submits a specially crafted timezone value can get the appliance to execute arbitrary operating-system commands, and those commands run with root privileges. Barracuda and Mandiant, who is credited with the disclosure, both rate it 8.6 on the CVSS 4.0 scale; NVD's own CVSS 3.1 scoring comes out somewhat lower, at 7.2, which is a reminder that the two scoring systems weigh "requires admin privileges" differently.

The catch with this one is the privilege requirement: exploitation needs an authenticated administrator session first. On its own, that limits the blast radius to attackers who have already compromised (or socially engineered their way into) an admin account. That is exactly why CISA's advisory, and Barracuda's, both flag that this bug becomes far more serious when paired with a second flaw that removes the authentication requirement entirely — which is what CVE-2026-116606 does.

CVE-2026-116606: Authentication Bypass on Email Security Gateway

CVE-2026-116606 is an authentication-bypass-using-an-alternate-path-or-channel flaw (CWE-288), and it is specific to Barracuda's Email Security Gateway. Per Barracuda's advisory, an unauthenticated remote attacker can reach the appliance's configuration-import function and restore a specially crafted backup archive, which changes the ESG's global configuration without ever supplying valid credentials. The one precondition is that the admin UI has to be network-reachable by the attacker — an internet-facing or otherwise exposed management interface is what turns this from a non-issue into a critical one.

Mandiant and Barracuda score it 9.3 on CVSS 4.0; NVD's CVSS 3.1 score is 9.8, both landing in critical territory. Barracuda's advisory states the flaw affects ESG versions before 9.4.0.030. Because no authentication is required at all, this is the half of the pair that most directly explains why CISA moved fast: an internet-exposed, unpatched ESG with CVE-2026-116606 is reachable by anyone who can route traffic to its admin UI.

CVE-2026-116606 is credited to Mandiant, which also disclosed CVE-2026-111560; both disclosures are published on Mandiant's public vulnerability-disclosure GitHub repository under reference IDs MNDT-2026-0041 and MNDT-2026-0042, respectively. Mandiant's write-ups are the technical source Barracuda's own advisory points back to, and they are the same references CISA cites in the notes field of both KEV entries.

Why Chaining the Two Flaws Is the Real Danger

Neither flaw in isolation is as alarming as the two combined. CVE-2026-116606 lets an unauthenticated attacker bypass the ESG's login entirely and push a malicious configuration restore; from there, an attacker effectively has the standing of an administrator inside the appliance. CVE-2026-111560 then gives that attacker (now authenticated, one way or another) a path to root-level command execution through the timezone field. Both CISA's KEV notes and Barracuda's advisory explicitly call out that the two CVEs "can be chained," and that doing so can hand an attacker full root access to the device — on a mail-security appliance that, by design, sits in the path of every inbound email and often holds credentials, logs, and relayed traffic for an organization's entire email flow.

It's worth noting what CISA has not said: neither the KEV entry nor Barracuda's public advisory claims a specific threat-actor attribution or ransomware linkage for this chain. CISA's KEV feed lists "knownRansomwareCampaignUse" as unknown for both entries. Barracuda's own advisory, last updated November 9, 2026, says only that the company "reported exploitation activity affecting a small number of organizations" — a limited-scope claim, not evidence of mass exploitation. Treat any more dramatic claims you see elsewhere about this chain as unverified unless they trace back to CISA or Barracuda directly.

Affected Products and Where to Get the Patch

CVE-2026-111560's timezone-injection bug reaches further than the ESG alone; CVE-2026-116606 is ESG-only. Barracuda has shipped firmware updates for every affected line. The patch identifiers below come directly from Barracuda's advisory.

Barracuda's cloud-delivered appliances typically receive firmware updates automatically, but the company's advisory still recommends administrators confirm their current firmware version against the patch IDs above rather than assume an auto-update already landed, particularly on on-premises or air-gapped deployments that pull updates on a slower cycle.

Is This Being Exploited Right Now?

Barracuda's advisory was first published November 2, 2026, and has been updated twice since: on November 5, the company revised the authentication field for CVE-2026-116606 to clarify that it requires the admin UI to be reachable, and on November 9 it disclosed limited exploitation activity. CISA's KEV catalog addition on November 10 followed that disclosure. The KEV catalog's entire purpose is to list vulnerabilities CISA has confirmed are being exploited in the wild, so the KEV listing itself is the strongest signal here: these are not theoretical bugs. For the most current status, Barracuda's security advisory is the primary source to monitor. That said, the scope Barracuda describes — "a small number of organizations" — does not indicate a mass-exploitation event, and nothing in either CISA's or Barracuda's public materials names a specific threat actor.

What the KEV Deadline Actually Means

CISA's KEV program carries legal force only for U.S. federal civilian executive branch agencies, which are bound by Binding Operational Directive 26-04 to remediate listed vulnerabilities by each entry's due date — in this case, November 13, 2026, for both CVEs. State, local, and private-sector organizations face no legal mandate, but CISA's published guidance is explicit that it expects "all organizations" to prioritize KEV-listed flaws in their own patch cycles. Given that one of the two flaws requires no authentication at all and the pair can be chained to root, any organization running an exposed ESG, WAF, ADC, BMA, WCC, or WSG appliance should treat the federal deadline as a reasonable target for itself, not just a government rule that doesn't apply to it. Security teams that have watched this pattern before with other KEV-listed edge devices will recognize the shape of it — a comparably compressed KEV deadline hit IBM's Aspera Faspex software earlier this year.

How to Patch and Reduce Exposure

Barracuda's advisory and CISA's required action point to the same basic steps:

• Identify affected appliances. Inventory every ESG, ADC, WAF, BMA, WCC, and WSG instance and check its current firmware version.
• Apply the patch ID for your product from the table above, or confirm cloud-managed units have already auto-updated.
• Restrict admin UI exposure. Since CVE-2026-116606 requires the admin interface to be reachable, taking management interfaces off the public internet (VPN or allow-listed access only) removes the precondition for that bug even before patching finishes.
• Audit admin accounts. Because CVE-2026-111560 needs an authenticated admin session, review who holds admin credentials and rotate any that may be shared or weakly protected — the kind of credential hygiene gap that underlies a lot of injection-style attacks, command injection included.
• Watch for Barracuda's own indicators. Barracuda's advisory is the authoritative source for any update on scope or indicators of compromise; check it directly rather than relying on secondhand summaries.

Internet-facing management interfaces have been a recurring theme in this year's KEV additions — a similar exposed-admin-UI precondition applies to the SonicWall SSL VPN bypass CISA flagged as under active attack, which is a useful comparison if you're triaging which edge devices to lock down first.

What's Next

Expect Barracuda to continue revising its advisory if exploitation scope changes — the company has already updated it twice since initial publication. CISA's KEV catalog entries can also be updated with new notes or revised due dates if circumstances change, so administrators should treat both the vendor advisory and the KEV JSON feed as living documents rather than one-time reads. For organizations still running affected hardware past end-of-support dates, Barracuda's and CISA's guidance converges on the same fallback: if no patch is available for your specific configuration, pull the device off the network or follow BOD 26-04's cloud-service guidance rather than leave an unpatched, internet-reachable admin interface in place.

Written bySana Qureshi

Sana Qureshi runs the security and privacy desk. She reports on actively exploited vulnerabilities, vendor patches and data breaches, and covers the password managers, VPNs and authentication tools readers use to protect themselves. Her alerts cite vendor advisories, CISA and the CVE record directly.

More from Sana QureshiAll Security & Privacy coverage