What happened
CISA added both Barracuda CVEs to the KEV catalog on 2026-11-10 with confirmed in-the-wild exploitation (Mandiant MNDT-2026-0041/0042 disclosures). CWE-78 / CWE-288.
Why it matters
Enterprise email/edge appliances, not AI-specific. Included per the KEV coverage rule (confirmed ITW exploitation is an operational signal).
Attack vector
CVE-2026-111560: OS command injection. CVE-2026-116606: authentication bypass via an alternate path lets an unauthenticated remote attacker invoke a config-import function and restore a crafted backup archive, changing configuration.
Affected systems
Multiple Barracuda appliances (see advisory)
Mitigation
Apply vendor mitigations per Barracuda trust advisory; CISA federal due date 2026-11-13.