[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f5IrER4RlO4ihD2gbywb0XtHA-5rkJgIuAvwgO2JHdlE":3},{"article":4,"iocs":55,"watch_terms":63,"solutions":64,"lesson":153},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"a3d9a0aa-f284-4cc2-bb4f-78d15504e53a","Recently Patched Barracuda Vulnerabilities Exploited in Attacks","recently-patched-barracuda-vulnerabilities-exploited-in-attacks-79d318","The security defects could allow attackers to bypass authorization and gain root access to devices. The post Recently Patched Barracuda Vulnerabilities Exploited in Attacks appeared first on SecurityWeek.","Threat actors are actively exploiting two recently patched Barracuda vulnerabilities, CVE-2026-116606 and CVE-2026-111560, which can be chained to bypass authorization and achieve root access on Barracuda Email Security Gateway appliances. CISA has added these vulnerabilities to its Known Exploited Vulnerabilities catalog, urging federal agencies to patch them promptly. Cybersecurity firm Previdian observed 17 exploitation attempts targeting CVE-2026-116606 from 15 IP addresses across three countries.","Barracuda ESG vulnerabilities are being exploited by threat actors to gain root access.","https:\u002F\u002Fwww.securityweek.com\u002Frecently-patched-barracuda-vulnerabilities-exploited-in-attacks\u002F","https:\u002F\u002Fwww.securityweek.com\u002Fwp-content\u002Fuploads\u002F2026\u002F11\u002FBarracuda.webp","2026-11-11T07:53:51+00:00","2026-11-11T08:00:18.872553+00:00",8,[17,20,23,26,28,30],{"name":18,"type":19},"Barracuda","vendor",{"name":21,"type":22},"Barracuda Email Security Gateway","product",{"name":24,"type":25},"Load Balancer Application Delivery Controller","technology",{"name":27,"type":25},"Web Application Firewall",{"name":29,"type":25},"Web Security Gateway",{"name":31,"type":25},"Message Archiver","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":32,"icon":34,"name":35,"slug":36},null,"Vulnerabilities","vulnerabilities",[38,43,48,50],{"category":39},{"id":40,"icon":34,"name":41,"slug":42},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":44},{"id":45,"icon":34,"name":46,"slug":47},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":49},{"id":32,"icon":34,"name":35,"slug":36},{"category":51},{"id":52,"icon":34,"name":53,"slug":54},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[56,60],{"type":57,"value":58,"context":59},"cve","CVE-2026-116606","Authentication bypass vulnerability in Barracuda ESG.",{"type":57,"value":61,"context":62},"CVE-2026-111560","Command injection vulnerability affecting multiple Barracuda products.",[18,21],{"controls":65,"vendors":152},[66,94,123],{"slug":67,"name":68,"problem":69,"products":70},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",[71,79,87],{"vendor_slug":72,"vendor_name":73,"vendor_logo":74,"product_slug":75,"product_name":76,"url":77,"description":78},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","idira-privileged-access-management","Idira Privileged Access Management","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fidira\u002Fhuman\u002Fprivileged-access-management","Privileged access management from the former CyberArk portfolio: vaulting, rotation, just-in-time access and session monitoring.",{"vendor_slug":80,"vendor_name":81,"vendor_logo":82,"product_slug":83,"product_name":84,"url":85,"description":86},"delinea","Delinea","\u002Fvendor-logos\u002Fdelinea.png","secret-server","Delinea Secret Server","https:\u002F\u002Fdelinea.com\u002Fproducts\u002Fsecret-server","Vault for privileged credentials with discovery, rotation and session recording.",{"vendor_slug":88,"vendor_name":89,"vendor_logo":90,"product_slug":67,"product_name":91,"url":92,"description":93},"threatlocker","ThreatLocker","\u002Fvendor-logos\u002Fthreatlocker.png","Privileged Access Management","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fprivileged-access-management","Gives elevated rights to specific applications only where needed, so users do not need local admin accounts.",{"slug":95,"name":96,"problem":97,"products":98},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[99,107,115],{"vendor_slug":100,"vendor_name":101,"vendor_logo":102,"product_slug":103,"product_name":104,"url":105,"description":106},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"vendor_slug":108,"vendor_name":109,"vendor_logo":110,"product_slug":111,"product_name":112,"url":113,"description":114},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"vendor_slug":116,"vendor_name":117,"vendor_logo":118,"product_slug":119,"product_name":120,"url":121,"description":122},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"slug":124,"name":125,"problem":126,"products":127},"patch-management","Automated patch management","Known holes get closed in days, not months.",[128,136,144],{"vendor_slug":129,"vendor_name":130,"vendor_logo":131,"product_slug":132,"product_name":133,"url":134,"description":135},"ivanti","Ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",{"vendor_slug":137,"vendor_name":138,"vendor_logo":139,"product_slug":140,"product_name":141,"url":142,"description":143},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"vendor_slug":145,"vendor_name":146,"vendor_logo":147,"product_slug":148,"product_name":149,"url":150,"description":151},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",[],{"slug":154,"title":155,"body":156,"framework_refs":157,"framework_notes":163},"chained-barracuda-flaws-exploited-in-the-wild-before-widespread-patching","Chained Barracuda Flaws Exploited in the Wild Before Widespread Patching","Threat actors rapidly weaponized two newly patched Barracuda Email Security Gateway vulnerabilities, chaining them together to bypass authorization and gain root access — a critical escalation path on a perimeter security appliance. The speed of exploitation (observed across 15 IP addresses in three countries) underscores how quickly attackers operationalize CVEs against unpatched internet-facing devices. CISA's addition of these CVEs to its Known Exploited Vulnerabilities catalog signals that passive patch cycles are insufficient for high-risk appliances. Organizations relying on email security gateways as a trust boundary must treat vendor-issued patches for such devices as emergency-priority updates, not routine maintenance.",[158,159,160,161,162],"CIS Control 7: Continuous Vulnerability Management (v8)","NIST SP 800-53 SI-2: Flaw Remediation","NIST CSF 2.0 RS.AN-03: Analysis of incidents","NIS2 Article 21(2)(e)","MITRE ATT&CK T1190: Exploit Public-Facing Application",{"NIS2 Article 21(2)(e)":164,"NIST SP 800-53 SI-2: Flaw Remediation":165,"NIST CSF 2.0 RS.AN-03: Analysis of incidents":166,"MITRE ATT&CK T1190: Exploit Public-Facing Application":167,"CIS Control 7: Continuous Vulnerability Management (v8)":168},"This point requires entities to have processes for vulnerability handling and disclosure, including rapid remediation of known exploited vulnerabilities in critical network components like email security gateways.","SI-2 mandates identifying, reporting, and correcting system flaws within organizationally defined time frames, which directly addresses the failure to patch the Barracuda gateway before active exploitation began.","This category calls for timely analysis of exploitation attempts, which aligns with the need to detect and act on the 17 observed exploitation attempts across multiple countries before damage escalates.","The attackers exploited publicly disclosed, internet-facing Barracuda appliance vulnerabilities to gain initial access, which is precisely the technique T1190 describes and for which detection and patching controls should be in place.","CIS Control 7 requires organizations to continuously assess and remediate vulnerabilities, particularly on internet-facing assets — a process that, if followed with urgency, would have driven patching before exploitation attempts were observed."]