Barracuda Vulnerabilities CVE-2026-116606 and CVE-2026-111560 Chained for Root Access in Active Attacks
Threat actors have begun exploiting two recently patched Barracuda vulnerabilities that can be chained to bypass authorization controls and obtain root access on affected appliances. CVE-2026-116606 is an authentication bypass flaw in Barracuda Email Security Gateway that allows an attacker with Admin UI access to restore a crafted backup archive and alter configuration. CVE-2026-111560 is a command injection vulnerability impacting multiple Barracuda products including ESG, Load Balancer ADC, WAF, WSG, BMA, and WCC, enabling root-level OS command execution with administrative access. Barracuda updated its advisory after observing exploitation against a small number of organizations, and CISA added both CVEs to its Known Exploited Vulnerabilities catalog with a three-day patching deadline for federal agencies. Cybersecurity firm Previdian recorded 17 exploitation attempts against CVE-2026-116606 from 15 IP addresses across three countries between November 9 and 11. Organizations are urged to apply updates immediately and restrict administrative interfaces to trusted internal networks only.
SecurityWeekNov 11, 2026Translated from English