Attackers exploit Barracuda ESG bypass and command injection
Original title: Barracuda’s email security gateways bitten by make-me-root vulns
Barracuda says a small number of organizations were hit; chaining the bugs can yield root on the device.
Barracuda says attackers are exploiting CVE-2026-116606, a pre-authentication authorization bypass in Email Security Gateway, with CVE-2026-111560, a command-injection flaw. Together they can bypass authorization and run commands as root if the admin interface is reachable. The injection bug also affects ADC, BMA, WAF, WCC, and WSG. Patches are out. Barracuda says it worked with affected customers and will not say how many were hit.
Unconfirmed: Barracuda has not said how many organizations were hit, who attacked, or whether root access was obtained.
- CVE-2026-116606 is rated CVSS 9.3 and needs access to the ESG admin UI.
- CVE-2026-111560 is rated 8.6 and affects ESG, ADC, BMA, WAF, WCC, and WSG.
- On November 2 Barracuda reported no active exploitation; it later confirmed attacks.
- Barracuda declined to say whether intruders gained root or who attacked.
Impact: root command execution on the gateway
| Product | Affected |
|---|---|
| Barracuda Email Security Gateway | — |
| Barracuda ADC | — |
| Barracuda Message Archiver | — |
| Barracuda Web Application Firewall | — |
| Barracuda WAF Control Center | — |
| Barracuda Web Security Gateway | — |
- 1.Install the Barracuda patches released for the affected products.
- 2.Do not leave the Email Security Gateway admin interface open to the internet.
- Vendors
- Barracuda
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-111560 | Command Injection in Barracuda Appliance Timezone Field | 8.6 | 1% | KEV | KEV |
| CVE-2026-116606 | Auth bypass in Barracuda Email Security Gateway before 9.4.0.030 | 9.3 | 2% | KEVPoC | KEV |
From the original article
2 min read at theregister.comSecurity company Barracuda warns that attackers are exploiting a pre-authentication authorization bypass bug and a command-injection vulnerability in its popular Email Security Gateway (ESG) products that, when chained, could allow the crims to run commands with root privileges.
By Jessica Lyons · theregister.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.