It’s on the Exploited List. The Clock Runs Out Friday.

CISA does not add a flaw to its Known Exploited Vulnerabilities catalog as a formality. The list means one thing: attackers are already using it, and the clock is running. On Tuesday, November 10, the agency added six flaws to the catalog — and two of them belong to Barracuda. Federal agencies have until Friday, November 13, to fix them. Three days. That is the shortest deadline in the batch, and it is not an accident.

The two flaws are the pair Barracuda disclosed on November 2, and the pair Barracuda confirmed was being exploited a week later. CISA’s listing turns a vendor warning into a federal order: patch by Friday, and check whether anyone was already inside before you did.

Two flaws, one chain, root access

The first flaw, CVE-2026-116606, scores 9.3. It is an authentication bypass in the Email Security Gateway’s admin interface: an unauthenticated attacker who can reach the interface invokes the configuration-import function and restores a crafted backup archive, rewriting the appliance’s global configuration. No login required. The second flaw, CVE-2026-111560, scores 8.6. It is an operating-system command injection in the timezone configuration field, and the injected commands run as root.

Either flaw alone is serious. Chained, they are the whole game: walk in through the admin door without a password, then run anything you want as root on the box that handles the organization’s email. Barracuda says successful attacks require access to the administrative interface — which is why the company’s first piece of advice has always been to keep that interface off the public internet and restricted to trusted internal networks.

The command-injection flaw reaches further than the gateway itself. It affects six Barracuda product lines: the Email Security Gateway, Load Balancer ADC, Message Archiver, WAF Control Center, Web Application Firewall, and Web Security Gateway. The authentication bypass is specific to the gateway. Patches for all of them have existed since November 2: gateway firmware 9.4.0.030, plus the per-product fixes Barracuda published the same day.

Why three days

KEV deadlines are usually measured in weeks. The other four flaws in Tuesday’s batch — Cisco BroadWorks, Openwave, Microsoft Outlook, and Google Chrome — carry a November 24 deadline. The Barracuda pair got November 13. Both Barracuda entries also carry a forensic-triage requirement. Under the binding directive that governs the catalog, agencies must not only patch — they must check whether threat actors compromised the system before the patch went on.

That triage requirement matters because of what these appliances are. An email security gateway sits in front of every message an organization sends and receives. Root access to one is not just a foothold; it is a vantage point over the mail flow itself, and a launchpad into the network behind it. Barracuda has said exploitation so far affects “a small number of organizations.” Small is not the same as zero.

Three years ago, the UNC4841 hacking group exploited Barracuda gateway zero-days for at least seven months before the flaws were patched — dropping previously unknown malware and stealing data. According to Mandiant, almost a third of the systems breached in that campaign belonged to government agencies. Barracuda’s gateways have more than 200,000 customers worldwide, from small businesses to large enterprises and managed service providers. Attackers do not wait for deadlines.

What to do before Friday

First, patch every affected product, not just the gateway. The injection flaw lives in shared appliance code across six lines, and the gateway alone is not the whole exposure. Gateway firmware 9.4.0.030 closes both flaws; the other products have their own per-product fixes from November 2. If automatic patching is off, turn it on — or apply the updates by hand and confirm the build numbers afterward.

Second, lock down the admin interface. If the administrative UI is reachable from the internet, restrict it to trusted internal networks now. The bypass flaw needs that interface to work at all, and an exposed admin page is the difference between a theoretical flaw and a live one.

Third, check for compromise, not just patch level. CISA’s triage requirement exists because a patched appliance can still be a breached one. Look for configuration restores you did not perform, new or changed admin accounts, unexpected scheduled tasks, and unfamiliar processes on the appliance. If anything looks wrong, treat the box as compromised and escalate — do not just update it and move on.

Fourth, rotate credentials that passed through the gateway. If the appliance handled mail or administrative credentials while it was exposed, assume they are no longer secret and change them.

The list is the signal

The other four entries in Tuesday’s batch are already on this blog: the BroadWorks flaw, the exploited Outlook flaw, and the Chrome zero-day. The sixth entry, Openwave’s messaging transcoder flaw, is lower severity. What makes the Barracuda pair stand out is the deadline. Three days is CISA saying the risk is not theoretical and the window is not generous.

Friday, November 13, is the federal deadline. It is a reasonable deadline for everyone else running these appliances, too. The patches have been out for nine days. The exploitation is confirmed. What is left is the part nobody can do for you: apply the fix, lock the door, and check whether anyone walked through it while it was open.