Barracuda security appliance flaws exploited to gain root access via CVE-2026-116606
TL;DR
Barracuda has patched two vulnerabilities, CVE-2026-116606 and CVE-2026-111560, that are being exploited to gain root access to security appliances. Attackers are targeting the Email Security Gateway to bypass authorization. Update your firmware immediately and restrict administrative interface access.
What happened
Barracuda released advisories on November 2, 2026, for two high-severity flaws that can be chained together to bypass authorization and grant an attacker root privileges. The first, CVE-2026-116606 (CVSS 9.3), is an authentication bypass in the Email Security Gateway (ESG) that allows an attacker with access to the Admin UI to restore a crafted backup and modify configurations. The second, CVE-2026-111560 (CVSS 8.6), is a command injection vulnerability affecting several products, including the ESG, Load Balancer ADC, WAF, WSG, BMA, and WCC.
CISA added both vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog after reports that threat actors are targeting a small number of organizations. Between November 9 and November 11, Previdian observed 17 attempts targeting CVE-2026-116606 originating from 15 IP addresses across three countries.
Why it matters
This is a critical chain. By combining an authentication bypass with a command injection, an attacker can move from administrative interface access to full root control over the appliance. Because these devices sit at the edge of your network, gaining root access provides a high-leverage foothold for further movement. The active exploitation of CVE-2026-116606 suggests that attackers are already scanning for and attempting to hit vulnerable ESG instances.
Who is affected
The following Barracuda products are vulnerable:
- Email Security Gateway (ESG)
- Load Balancer Application Delivery Controller (ADC)
- Web Application Firewall (WAF)
- Web Security Gateway (WSG)
- Message Archiver (BMA)
- WAF Control Center (WCC)
What to do now
- Upgrade all affected appliances to the latest firmware version immediately.
- Restrict access to administrative interfaces so they are only reachable from trusted internal networks.
- Enable automatic patching if it is currently disabled.
- Contact Barracuda Support if your firmware is multiple versions out of date to ensure a proper update path.
What we don't know yet
- The specific identity or attribution of the threat actors performing these attacks.
- The total number of organizations that have been successfully breached.
- The exact root cause of the vulnerabilities within the code.
Sources
