[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fbaV-CzY9y6TNJe75MQAgnOxMI32DB4NF0FOT8kD9KlY":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":17,"status":23,"created_at":24,"published_at":25,"article":26,"tags":30,"podcasts":43,"controls":44},"a102cdce-13b4-4431-b95f-962e9e9d043e","chained-barracuda-flaws-exploited-in-the-wild-before-widespread-patching","a3d9a0aa-f284-4cc2-bb4f-78d15504e53a","Chained Barracuda Flaws Exploited in the Wild Before Widespread Patching","Threat actors rapidly weaponized two newly patched Barracuda Email Security Gateway vulnerabilities, chaining them together to bypass authorization and gain root access — a critical escalation path on a perimeter security appliance. The speed of exploitation (observed across 15 IP addresses in three countries) underscores how quickly attackers operationalize CVEs against unpatched internet-facing devices. CISA's addition of these CVEs to its Known Exploited Vulnerabilities catalog signals that passive patch cycles are insufficient for high-risk appliances. Organizations relying on email security gateways as a trust boundary must treat vendor-issued patches for such devices as emergency-priority updates, not routine maintenance.","**Immediate actions:**\n- Apply Barracuda's patches for CVE-2026-116606 and CVE-2026-111560 immediately, or isolate affected appliances until patching is complete.\n- Cross-reference your asset inventory against CISA's Known Exploited Vulnerabilities catalog daily and trigger escalation workflows for any match.\n- Block the 15 known attacker IP addresses and their associated ASNs at the perimeter firewall while patching is underway.\n\n**Long-term improvements:**\n- Establish an emergency patching SLA (e.g., 24–72 hours) specifically for internet-facing security appliances when CISA KEV entries are published.\n- Maintain a continuously updated inventory of all network appliances, including firmware versions, so patch scope can be assessed within minutes of a disclosure.\n- Implement network segmentation to ensure email gateway appliances cannot be used as a pivot point to reach internal systems if compromised.\n\n**Detection measures:**\n- Deploy automated vulnerability scanning targeted at internet-facing appliances with scans triggered on new CVE disclosures, not just on a fixed schedule.\n- Configure SIEM alerting for anomalous outbound connections or privilege escalation events originating from email gateway appliances.\n- Monitor threat intelligence feeds for exploitation indicators (IPs, payloads) associated with newly disclosed appliance CVEs and ingest them into blocking rules automatically.",[12,13,14,15,16],"CIS Control 7: Continuous Vulnerability Management (v8)","NIST SP 800-53 SI-2: Flaw Remediation","NIST CSF 2.0 RS.AN-03: Analysis of incidents","NIS2 Article 21(2)(e)","MITRE ATT&CK T1190: Exploit Public-Facing Application",{"NIS2 Article 21(2)(e)":18,"NIST SP 800-53 SI-2: Flaw Remediation":19,"NIST CSF 2.0 RS.AN-03: Analysis of incidents":20,"MITRE ATT&CK T1190: Exploit Public-Facing Application":21,"CIS Control 7: Continuous Vulnerability Management (v8)":22},"This point requires entities to have processes for vulnerability handling and disclosure, including rapid remediation of known exploited vulnerabilities in critical network components like email security gateways.","SI-2 mandates identifying, reporting, and correcting system flaws within organizationally defined time frames, which directly addresses the failure to patch the Barracuda gateway before active exploitation began.","This category calls for timely analysis of exploitation attempts, which aligns with the need to detect and act on the 17 observed exploitation attempts across multiple countries before damage escalates.","The attackers exploited publicly disclosed, internet-facing Barracuda appliance vulnerabilities to gain initial access, which is precisely the technique T1190 describes and for which detection and patching controls should be in place.","CIS Control 7 requires organizations to continuously assess and remediate vulnerabilities, particularly on internet-facing assets — a process that, if followed with urgency, would have driven patching before exploitation attempts were observed.","published","2026-11-11T08:20:26.953283+00:00","2026-11-11T08:20:26.939+00:00",{"id":7,"url":27,"slug":28,"title":29},"https:\u002F\u002Fwww.securityweek.com\u002Frecently-patched-barracuda-vulnerabilities-exploited-in-attacks\u002F","recently-patched-barracuda-vulnerabilities-exploited-in-attacks-79d318","Recently Patched Barracuda Vulnerabilities Exploited in Attacks",[31,37],{"id":32,"name":33,"slug":34,"description":35,"color":36},"05757c8d-6b93-4194-b35d-7359e7d33b0e","Vulnerability Management","vulnerability-management","Missing scans, no risk prioritization","#fb923c",{"id":38,"name":39,"slug":40,"description":41,"color":42},"af7fce9e-1ce8-4156-93bc-09dcfbfdf29d","Patch Management","patch-management","Unpatched vulnerabilities, delayed updates","#ef4444",[],[45,49,52],{"slug":46,"name":47,"problem":48},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",{"slug":34,"name":50,"problem":51},"Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",{"slug":40,"name":53,"problem":54},"Automated patch management","Known holes get closed in days, not months."]