If your mail runs through a Barracuda Email Security Gateway, treat the unpatched window as a credential reset event.
The Hacker News reports two flaws in the email filtering appliance that chain into running commands as root, its highest level of access, with no login required: the company shipped patches on Monday. RS Web Solutions notes a WordPress Core flaw sitting on CISA's critical vulnerabilities list. BigGo Finance reports that Bic Camera Group says data on about 14.9 million customer email addresses may have leaked after unauthorized access at contractor Arara.
One pattern: the exposed thing was software you did not write. An appliance in front of your mail, a CMS core, a contractor holding your customer list...
I review payment and account flows, including what outside vendors can reach. Send me your list of edge appliances and vendors with account access, and you get cost and timeline within a day.