decrypted · 11 november 2026 · vulnerabilities and patching · uk policy and law · ai and llm security

Barracuda's mail gateway has gone from patched to under attack

Barracuda's Email Security Gateway, the appliance that sits in front of an organisation's mail and filters it, has gone from "patched" to "under attack" in about a week. Barracuda released fixes on 2 November for two flaws that together hand an attacker full control of the box. On 10 November America's CISA added both to its KEV list, the catalogue of flaws known to be exploited in real attacks. If you run one, today's job is to confirm the patch is on, not to schedule it.

Two small doors, one big hallway

The first flaw, CVE-2026-116606 (a CVE being the public reference number each flaw gets), scores 9.3 on the CVSS severity scale. Mandiant, as reported by SecurityWeek, says it lets a remote attacker call a function that restores a configuration backup, so a crafted backup can rewrite the appliance's settings. The second, CVE-2026-111560, scores 8.6 and is command injection in the timezone setting: text typed into a settings field is treated as an instruction to run. It runs as root, the all-powerful account.

Picture a hotel where a forged room-service order lets you change the locks, and the new lock lets you walk into the manager's office. Chained, the two flaws end in total control of a device that, by design, reads every message your organisation receives.

What defenders can and cannot tell

Barracuda's advisory has been awkward. It first said administrator access was required, and BleepingComputer reports it was changed on 6 November so that attackers do not need admin privileges. The fixed version is also disputed: Barracuda's documentation says 9.4.0.029 or later, while Mandiant says anything earlier than 9.4.0.030 is vulnerable. Aim for the higher. eSecurityPlanet notes that multi-factor authentication, a second check on top of the password, does not help, because the bypass skips the login altogether.

SecurityOnline reports that Barracuda has confirmed attacks on a small number of organisations and that public exploit code exists. I could not verify either from a primary source, so treat them as claims, but plan as if both are true.

The Secure by Design lesson

Two design decisions did the damage. An administrative function, restoring a backup, could be reached without proof of identity. And a settings field was passed to the operating system without being treated as untrusted input. Both are ordinary mistakes. SecurityWeek recalls that the same product family was hit by Chinese cyberspies through CVE-2023-2868, exploited from October 2022. A mail gateway is a rich target because it sees everything and holds high privilege.

For UK organisations the cost of applying the lesson is modest:

Keep appliance admin interfaces off the internet, on a management network. Barracuda's own wording says the attacker must reach that interface.
Inventory every such box, including the forgotten one at a subsidiary.
Ask suppliers how long they will patch a product and how they will tell you.
If the box was exposed and unpatched, patching is not enough. Assume the configuration may have been altered and compare it with a known-good copy.

Also this week

Policy: the warning and the liability question. At the NCSC's annual review on 3 November, chief executive Richard Horne warned of "the real prospect of an unprecedented rise in the number of cyber incidents", according to The Record. His point was not that AI has invented new attacks but that long-tolerated vulnerabilities can now be found and exploited at scale, and he noted that the Linux kernel project patched more than a thousand last month. The Budget on 28 October supplied the policy half: a commitment to consult next year on tackling insecure technology at source and on where liability for cyber breaches should sit. It is one bullet in a 166-page document, with no lead department or date named. It sits beside the Law Commission's product liability review, which runs to 14 January and would stretch the meaning of "product" under the Consumer Protection Act 1987 to cover software and AI. A settings field that runs commands is exactly the case it is aimed at.

Adverts in the agent's instructions. On 3 November Check Point Research described Haiou, a free jailbreak bundle for OpenAI Codex. According to the Cloud Security Alliance and Gridinsoft, it edits the agent's global instruction files so that a greeting returns an advert for the author's AI gateway, and the payload itself is plain language, not code. It was found on an exposed server used by a Cobalt Strike operator, and had 403 stars and 77 forks on GitHub by 4 November, which the Alliance notes measures attention, not installations. Neither source reports data theft. The lesson is that instruction files are now part of the attack surface: baseline them, allowlist the model endpoints your tools may call, and watch for changes.

Sources