Threat actors have started exploiting two recently patched Barracuda vulnerabilities that could be chained to bypass authorization controls and gain root access.
Tracked as CVE-2026-116606 (CVSS score of 9.3), the first bug is described as an authentication bypass in Barracuda Email Security Gateway (ESG). An attacker with access to the administrative user interface (Admin UI) could trigger it to restore a crafted backup archive and modify the appliance’s configuration.
The second flaw, CVE-2026-111560 (CVSS score of 8.6), is a command injection weakness affecting Barracuda ESG, Load Balancer Application Delivery Controller (ADC), Web Application Firewall (WAF), Web Security Gateway (WSG), Message Archiver (BMA), and WAF Control Center (WCC). An attacker with administrative access to a vulnerable appliance could exploit the security hole to inject OS commands that would be executed with root privileges.
“If exploited in combination, these vulnerabilities could allow an attacker to bypass authorization controls and obtain root access to the device,” Barracuda said on November 2.
A week later, the company updated its advisory to warn that threat actors have been exploiting the two security defects against a small number of organizations. On Tuesday, the US cybersecurity agency CISA added CVE-2026-116606 and CVE-2026-111560 to its Known Exploited Vulnerabilities (KEV) catalog, urging federal agencies to patch them within three days, as mandated by BOD 26-04.
Barracuda and CISA have not shared details on the exploitation, but cybersecurity firm Previdian has observed 17 attempts targeting CVE-2026-116606 between November 9 and November 11. The attacks came from 15 IP addresses in three countries.
All organizations are advised to update their Barracuda products as soon as possible and ensure that their administrative interfaces are not exposed to the internet. Access to them should be restricted only to trusted internal networks.
