Chained Barracuda Flaws Exploited in the Wild Before Widespread Patching
Written by AI from the linked story. Not reviewed by an editor. How this works
Threat actors rapidly weaponized two newly patched Barracuda Email Security Gateway vulnerabilities, chaining them together to bypass authorization and gain root access — a critical escalation path on a perimeter security appliance. The speed of exploitation (observed across 15 IP addresses in three countries) underscores how quickly attackers operationalize CVEs against unpatched internet-facing devices. CISA's addition of these CVEs to its Known Exploited Vulnerabilities catalog signals that passive patch cycles are insufficient for high-risk appliances. Organizations relying on email security gateways as a trust boundary must treat vendor-issued patches for such devices as emergency-priority updates, not routine maintenance.
Tactical Insight
Immediate actions
- Apply Barracuda's patches for CVE-2026-116606 and CVE-2026-111560 immediately, or isolate affected appliances until patching is complete.
- Cross-reference your asset inventory against CISA's Known Exploited Vulnerabilities catalog daily and trigger escalation workflows for any match.
- Block the 15 known attacker IP addresses and their associated ASNs at the perimeter firewall while patching is underway.
Long-term improvements
- Establish an emergency patching SLA (e.g., 24–72 hours) specifically for internet-facing security appliances when CISA KEV entries are published.
- Maintain a continuously updated inventory of all network appliances, including firmware versions, so patch scope can be assessed within minutes of a disclosure.
- Implement network segmentation to ensure email gateway appliances cannot be used as a pivot point to reach internal systems if compromised.
Detection measures
- Deploy automated vulnerability scanning targeted at internet-facing appliances with scans triggered on new CVE disclosures, not just on a fixed schedule.
- Configure SIEM alerting for anomalous outbound connections or privilege escalation events originating from email gateway appliances.
- Monitor threat intelligence feeds for exploitation indicators (IPs, payloads) associated with newly disclosed appliance CVEs and ingest them into blocking rules automatically.