Barracuda flaws exploited to gain root access to devices

Threat actors are actively exploiting two recently patched Barracuda vulnerabilities that could be chained to bypass authentication and achieve root access on Barracuda devices. The first flaw, CVE-2026-116606, is described by Barracuda as an authentication bypass in Barracuda Email Security Gateway (ESG), which could let an attacker with access to the Admin UI restore a crafted backup archive and modify the appliance’s configuration.

The second vulnerability, CVE-2026-111560, is a command injection weakness affecting ESG, Load Balancer ADC, WAF, WSG, BMA, and WCC. Exploitation of this flaw could allow OS commands to be executed with root privileges. Barracuda warned that, when leveraged together, these defects could enable an attacker to bypass authorization and gain root access to the device.

Evidence and response: security firm Previdian has observed 17 attempts targeting CVE-2026-116606 between 9 and 11 November, originating from 15 IP addresses across three countries. The US CISA subsequently added both CVEs to its Known Exploited Vulnerabilities (KEV) catalog, urging federal agencies to patch within three days under BOD 26-04. Barracuda and CISA have not disclosed exploitation specifics.

Practically, organisations are advised to update Barracuda products promptly and ensure administrative interfaces are not exposed to the internet, restricting access to trusted internal networks. The article notes that CISA’s KEV listing and observed activity indicate credible exploitation, but details remain limited.