Attackers are exploiting two Barracuda flaws to reach root on affected appliances
Barracuda has confirmed exploitation against a small number of organizations, and customers are urged to patch now and keep admin interfaces off the internet.
Attackers are now actively exploiting two Barracuda flaws patched about a week earlier, which can be chained to bypass authorization and gain root on affected appliances. CVE-2026-116606 (CVSS 9.3) is an authentication bypass in Email Security Gateway that lets someone with Admin UI access restore a crafted backup and alter the configuration, while CVE-2026-111560 (CVSS 8.6) is a command injection flaw spanning several Barracuda products that runs injected OS commands as root. Barracuda confirmed exploitation against a small number of organizations and urged customers to apply patches immediately, enable automatic patching if it was turned off, and keep admin interfaces off the internet. CISA has added both bugs to its Known Exploited Vulnerabilities catalog and told federal agencies to patch within three days, and Previdian reported 17 attempts against CVE-2026-116606 from 15 IP addresses in three countries between November 9 and 11.
Why it matters
Organizations running Barracuda Email Security Gateway and related products face active attacks that can give intruders root control of the device, not just a foothold. Because both flaws can be chained and the bugs are already in CISA's catalog, the patches are no longer a routine update, and the exposure of administrative interfaces to the internet is the factor that most affects who is at risk.
Matters or hype?
Does this story matter, or is it hype? Vote before you see what everyone else said.