Threat watch / Vulnerability
Barracuda: attackers exploit two flaws that give root on Email Security Gateway appliances
On November 2, 2026, Barracuda patched two flaws in its Email Security Gateway and five other appliances. Chained, they let an attacker who can reach the admin interface bypass authorization and get root on the device. On November 9, Barracuda added that it has "identified exploitation activity affecting a small number of organizations".
- Sector
- Many sectors
- Way in
- Software flaw
- Product or vendor
- Barracuda Email Security Gateway, Barracuda Load Balancer ADC, Barracuda Message Archiver, Barracuda WAF Control Center, Barracuda Web Application Firewall, Barracuda Web Security Gateway
- How it happened
- CVE-2026-116606 (CVSS 9.3, ESG only) is an authorization bypass that lets an attacker change the appliance's global configuration. CVE-2026-111560 (CVSS 8.6) is an OS command injection that runs as root. Barracuda says exploitation requires access to the administrative interface and that, combined, the two flaws give root on the device. How the observed attacks were carried out is not public.[1][2] Checked 10 Nov 2026
- What was stolen
- Not public yet Checked 10 Nov 2026
- Who was impacted
- "A small number of organizations", according to Barracuda, which gives no count and names none.[1] Checked 10 Nov 2026
- Threat actor
- Not attributed
- CVE
- CVE-2026-116606, CVE-2026-111560
Timeline
- Barracuda publishes its advisory and patches: BNSF-40425 and BNSF-40430 for ESG, plus fixes for Load Balancer ADC, Message Archiver, WAF Control Center, Web Application Firewall and Web Security Gateway. Patches are applied automatically where possible. [1]
- Barracuda corrects its advisory: CVE-2026-116606 needs no authentication, only that the attacker can reach the admin interface. [1]
- Barracuda updates the advisory: "We have identified exploitation activity affecting a small number of organizations." It advises restricting admin interfaces to trusted internal networks and checking that patches are applied. [1][2]
- CISA adds both flaws to its Known Exploited Vulnerabilities catalog, with a three-day deadline for federal agencies, according to SecurityWeek. Neither Barracuda nor CISA has shared details on the attacks. The firm Previdian says it saw 17 attempts against CVE-2026-116606 from 15 IP addresses in three countries between November 9 and 11, SecurityWeek reports. [3]