Barracuda's mail gateway has gone from patched to under attack

Evening edition, Wednesday 11 November 2026

Two Barracuda Email Security Gateway flaws that chain to root control were added to CISA's exploited list on 10 November, days after the fixes. The Secure by Design lesson, plus the UK liability consultation and a prompt adware case.

Sources

• CISA: Adds Six Known Exploited Vulnerabilities to Catalog (10 November 2026)
• SecurityWeek: Barracuda Email Security Gateway authentication bypass opens path to root
• BleepingComputer: Barracuda warns of critical flaws allowing root access to devices
• SecurityOnline: CISA adds six exploited flaws to the KEV catalog
• The Record: UK to look at making software companies liable for cyber breaches
• Cloud Security Alliance: Prompt adware and agent instruction persistence

Read the written version