Threat actors have begun exploiting two recently patched vulnerabilities in Barracuda’s Email Security Gateway (ESG) product, which could allow them to gain root access to devices. The flaws, tracked as CVE-2026-116606 and CVE-2026-111560, were initially addressed by the company on November 2, but it has now been confirmed that attackers are targeting these vulnerabilities.
The first vulnerability, CVE-2026-116606, is an authentication bypass bug that allows an attacker with access to the administrative user interface (Admin UI) to restore a crafted backup archive and modify the device’s configuration. This could potentially give attackers unrestricted access to the system. The second flaw, CVE-2026-111560, is a command injection weakness affecting multiple Barracuda products, including ESG, Load Balancer Application Delivery Controller (ADC), Web Application Firewall (WAF), and others. An attacker with administrative access can exploit this security hole to inject OS commands that would be executed with root privileges.
Barracuda has warned that if exploited in combination, these vulnerabilities could allow attackers to bypass authorization controls and gain root access to the device. The US Cybersecurity and Infrastructure Security Agency (CISA) has added both CVEs to its Known Exploited Vulnerabilities (KEV) catalog, urging federal agencies to patch them within three days as mandated by BOD 26-04.
According to cybersecurity firm Previdian, there have been at least 17 attempts targeting CVE-2026-116606 between November 9 and 11. These attacks originated from 15 IP addresses in three countries. It’s essential for all organizations using Barracuda products to update them as soon as possible and ensure that their administrative interfaces are not exposed to the internet. Access to these interfaces should be restricted only to trusted internal networks.
The exploitation of these vulnerabilities highlights the importance of timely patching and secure configuration practices. Organizations must stay vigilant and address security gaps promptly, especially when it comes to high-severity flaws like these. With the recent surge in attacks targeting previously patched vulnerabilities, it’s clear that threat actors are becoming increasingly aggressive in exploiting known weaknesses.
To mitigate this risk, organizations should prioritize regular software updates, implement secure configuration practices, and restrict access to administrative interfaces. By taking proactive steps to address security vulnerabilities, organizations can significantly reduce their exposure to potential attacks and protect themselves against the evolving threat landscape.
Source: SecurityWeek — 2026-11-11