CISA KEV additions November 10, 2026; Barracuda federal remediation due Friday, November 13, 2026
One Day Left on the Shortest Clock in the Batch: Barracuda Triage Is Due Friday
Tomorrow, Friday, November 13, is the federal deadline for the Barracuda pair, the shortest clock CISA set in the November 10 batch, where the other four entries received November 24. The two flaws chain. CVE-2026-116606, scored 9.3, is an authentication bypass in the Barracuda Email Security Gateway administrative interface: an unauthenticated attacker who can reach the interface can invoke the configuration import function and restore a crafted backup archive, rewriting the appliance global configuration. CVE-2026-111560, scored 8.6, is an operating system command injection in the timezone configuration field, and the injected commands run as root. The bypass is specific to the gateway, but the injection flaw reaches six Barracuda product lines: the Email Security Gateway, Load Balancer ADC, Message Archiver, WAF Control Center, Web Application Firewall, and Web Security Gateway. Patches have existed since November 2, with gateway firmware 9.4.0.030 closing both flaws and per-product fixes for the other lines. Barracuda has said exploitation affects a small number of organizations, and both KEV entries carry a forensic triage requirement: patching alone does not satisfy the deadline, because the agencies must also check whether the system was compromised before the patch went on. The product history sharpens the point: three years ago the UNC4841 group exploited Barracuda gateway zero-days for at least seven months before fixes shipped, and gateways sit in front of the mail flow for more than 200,000 customers worldwide.
Executives
Today is the last ordinary working day before the deadline, so the question to ask this morning is direct: is every Barracuda appliance, including any a provider runs on your behalf, on the fixed firmware, with the triage result recorded? Treat a patch-only answer as incomplete. The appliance in question filters the organization mail, which makes a quiet compromise there a mail exposure, not a device incident, and that difference decides who needs to be in the room if the triage finds anything.
CIO / CISO
Work all six product lines, not only the gateway, because the injection flaw lives in shared appliance code. Confirm firmware 9.4.0.030 or later on each Email Security Gateway and the per-product fixes elsewhere, then run the triage the directive requires: configuration restores your team did not perform, new or changed administrator accounts, unexpected scheduled tasks, and unfamiliar processes. Keep administrative interfaces off the public internet as a permanent state, and rotate credentials that passed through an exposed gateway while it was unpatched.
Engineers
Verify the build on each appliance itself and turn automatic patching back on where it was disabled. Hunt the specific artifacts this chain leaves: imported configuration archives with no matching change record, timezone field changes, and root-level processes that do not belong to the appliance normal set. Preserve logs and configuration snapshots before the firmware update overwrites them, because the triage evidence is perishable and the deadline is tomorrow.
Everyone (non-IT)
There is nothing for individual staff to install, and no message about a mail gateway that should ask you to sign in or share a password. If IT announces mail filtering maintenance today or tomorrow, that is this deadline being met. Treat any urgent message claiming your mailbox will be suspended unless you act as the kind of lure that rides a public patch deadline, and report it instead of answering it.