CISA Gives Federal Agencies Three Days to Patch Barracuda Gateways

CVE-2026-116606 and CVE-2026-111560, two Barracuda flaws, are being exploited in the wild; on Tuesday, CISA ordered federal agencies to patch by Friday, November 13. [Barracuda appliances are on CISA's exploited list]

The first flaw is a pre-authentication authorization bypass in the Email Security Gateway, scored 9.3. The second is an operating-system command injection in a timezone configuration field, scored 8.6. CISA's listing says the two can be chained. [Barracuda appliances are on CISA's exploited list]

The chain is the attack. The bypass needs no credentials and opens the appliance's administrative surface; the injection turns an ordinary settings field into operating-system commands. Run in sequence, an outsider with no password gets command execution on the box that filters an organization's email — the one machine that sees every attachment, every invoice and every password-reset link the company receives. [Barracuda appliances are on CISA's exploited list]

The timeline shows how fast 'theoretical' became 'confirmed.' Barracuda published its advisory on November 2 and updated it on November 5. On Monday, November 9, at 9:00 p.m. EST, the company added the sentence that moves a flaw from the patch queue to the incident queue: it had 'identified exploitation activity affecting a small number of organizations.' On Tuesday, November 10, CISA added both identifiers to its Known Exploited Vulnerabilities catalog, due date November 13, both flagged for forensic triage, ransomware use listed as unknown. Mandiant tracks the injection flaw as MNDT-2026-0041. [Barracuda appliances are on CISA's exploited list] [CISA adds six known exploited vulnerabilities (Nov 10)]

The blast radius is wider than the mail gateway. The bypass is confined to the Email Security Gateway, but the command injection also affects five other Barracuda products: the Load Balancer ADC, Message Archiver, WAF Control Center, Web Application Firewall and Web Security Gateway. An inventory that only counts mail appliances under-patches the problem by design. [Barracuda appliances are on CISA's exploited list]

And the deadline's real content is the triage flag. Patching closes the hole; it doesn't evict anyone who walked through it between November 2 and the patch. CISA's three-day clock binds federal agencies by order, and the same catalog is the private sector's de facto priority list. The work order reads: patch by Friday, then hunt. [Barracuda appliances are on CISA's exploited list] [CISA adds six known exploited vulnerabilities (Nov 10)]