Barracuda Vulnerabilities Actively Exploited for Root Access, CISA Warns
Share
Threat actors are actively exploiting two recently patched vulnerabilities in Barracuda Networks products, prompting the US Cybersecurity and Infrastructure Security Agency (CISA) to add the flaws to its Known Exploited Vulnerabilities (KEV) catalogue.
The vulnerabilities, tracked as CVE-2026-116606 and CVE-2026-111560, can be chained to bypass authorisation controls and obtain root access on affected Barracuda appliances.
CVE-2026-116606, an authentication bypass flaw with a CVSS score of 9.3, affects the Barracuda Email Security Gateway (ESG). An attacker with access to the administrative user interface (Admin UI) could trigger this vulnerability to restore a specially crafted backup archive and modify the appliance’s configuration.
The second flaw, CVE-2026-111560, is a command injection weakness with a CVSS score of 8.6. It impacts Barracuda ESG, Load Balancer Application Delivery Controller (ADC), Web Application Firewall (WAF), Web Security Gateway (WSG), Message Archiver (BMA), and WAF Control Center (WCC). This vulnerability allows an attacker with administrative access to inject and execute operating system commands with root privileges.
Barracuda confirmed the exploitation in an advisory updated on 2 November, warning that a small number of organisations had been targeted. While specific details on the nature of the attacks remain limited, the company indicated that the combined exploitation of these vulnerabilities could lead to full device compromise.
On 10 November, CISA added both CVE-2026-116606 and CVE-2026-111560 to its KEV catalogue, which mandates federal agencies to patch the vulnerabilities within three days to protect against active threats.
Independent observations from cybersecurity firm Previdian indicated 17 exploitation attempts targeting CVE-2026-116606 between 9 November and 11 November. These attacks originated from 15 different IP addresses across three countries, underscoring the active and widespread nature of the threat.
All organisations using affected Barracuda products are advised to update their devices immediately. Furthermore, Barracuda and CISA recommend restricting access to administrative interfaces to trusted internal networks only, preventing external exposure to potential attackers.
