Attackers exploit patched Barracuda flaws chained for root access
Original title: Recently Patched Barracuda Vulnerabilities Exploited in Attacks
CISA gave federal agencies three days to patch both flaws after attacks on a small number of organizations.
Threat actors are exploiting two recently patched Barracuda bugs that can be chained to bypass authorization and obtain root. CVE-2026-116606 is an authentication bypass in Email Security Gateway; CVE-2026-111560 is command injection across several appliances. Barracuda said a small number of organizations were hit. CISA added both to the KEV catalog and set a three-day federal deadline under BOD 26-04.
Unconfirmed: Barracuda and CISA have not shared exploitation details; Previdian's count covers only CVE-2026-116606.
- CVE-2026-116606 scores 9.3 and can restore a crafted backup from the Admin UI.
- CVE-2026-111560 scores 8.6 and runs injected OS commands as root.
- Command injection also affects ADC, WAF, WSG, BMA, and WCC.
- Previdian saw 17 attempts from 15 IP addresses in three countries.
- Those attempts ran from November 9 to November 11.
Impact: Root access after bypassing authorization controls
| Product | Affected |
|---|---|
| Barracuda Email Security Gateway | — |
| Barracuda Load Balancer ADC | — |
| Barracuda Web Application Firewall | — |
| Barracuda Web Security Gateway | — |
| Barracuda Message Archiver | — |
| Barracuda WAF Control Center | — |
- 1.Update Barracuda products as soon as possible.
- 2.Restrict administrative interfaces to trusted internal networks.
- 3.Federal agencies must patch within three days under BOD 26-04.
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-111560 | Command Injection in Barracuda Appliance Timezone Field | 8.6 | 1% | KEV | KEV |
| CVE-2026-116606 | Auth bypass in Barracuda Email Security Gateway before 9.4.0.030 | 9.3 | 2% | KEVPoC | KEV |
From the original article
1 min read at securityweek.com
The security defects could allow attackers to bypass authorization and gain root access to devices. The post Recently Patched Barracuda Vulnerabilities Exploited in Attacks appeared first on SecurityWeek.
By Ionut Arghire · securityweek.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.