CISAAnalysisCISA mandates urgent remediation deadline for Barracuda Email Gateway vulnerabilities
What happened.CISA established an expedited three-day remediation deadline ordering federal agencies to patch chained remote code execution vulnerabilities in Barracuda Email Security Gateway appliances.
Why it matters.Email security appliances process inbound corporate communications and reside directly on the public internet perimeter. When chained zero-day vulnerabilities grant unauthenticated root access, threat groups establish persistent backdoors and exfiltrate confidential enterprise correspondence. Security administrators managing Barracuda appliances must verify that firmware hotfixes have applied across all physical and virtual units. Incident response teams should inspect network flow logs for unusual outbound connections from gateway appliances.
The technical specifications:
- Vulnerability chaining: Attackers combine CVE-2026-116606 for authentication bypass with CVE-2026-111560 for arbitrary operating system command injection.
- Root execution: The exploit sequence enables unauthenticated remote actors to bypass security boundaries and execute arbitrary commands with root privileges.
- Active exploitation: Threat intelligence confirmed ongoing real-world campaigns targeting internet-facing enterprise email security gateway appliances.
- Federal directive: CISA added both flaws to the Known Exploited Vulnerabilities catalog under Binding Operational Directive 26-04 with a strict deadline.
- Vendor remediation: Barracuda distributed automated cloud patches and released hotfixes for customer-managed appliances to neutralize unauthorized command execution.