Two recently patched Barracuda vulnerabilities are now on CISA's exploited list, just a week after fixes shipped.
SecurityWeek reports that two Barracuda vulnerabilities, patched only days earlier, are already being exploited. CVE-2026-116606 is an authentication bypass in Barracuda's Email Security Gateway, rated CVSS 9.3, and CVE-2026-111560 is a command injection flaw, rated CVSS 8.6, affecting several other Barracuda products. The two can be chained for authorization bypass and root-level access on affected systems.
CISA added both flaws to its Known Exploited Vulnerabilities catalog on November 10, giving federal agencies until November 24 to patch. Security firm Previdian said it recorded 17 exploitation attempts against the authentication-bypass flaw, coming from 15 IP addresses across three countries between November 9 and 11.
Why it matters: email security gateways sit at the perimeter and guard credentials and sensitive mail flow, and a gap this short between patch and exploitation shows why internet-facing security appliances need to be patched on sight, not on a routine cycle, with monitoring kept up even after the update lands.