Science & Tech · Cybersecurity · 5 hrs ago
Attackers exploit patched Barracuda email gateway flaws
Barracuda says attackers are exploiting two flaws in its products, including its Email Security Gateway, which protects email systems.
The company says a small number of organizations have been affected so far.
The vulnerabilities were patched last week, but attacks require access to a targeted device’s administrative interface.
Used together, the flaws could let attackers gain root access, giving them deep control of the device.
That access could allow intruders to steal data or install backdoors, though it is not known whether attackers have done so in these cases.
Barracuda says it has worked with affected organizations and released patches for the affected products.
Customers should apply the patches and restrict access to admin interfaces to trusted networks.
Barracuda says attackers are exploiting two recently patched vulnerabilities in its products, affecting a small number of organizations.
When combined, the flaws could let attackers bypass authorization controls and run commands with root privileges.
The vulnerabilities are CVE-2026-116606 and CVE-2026-111560, and Barracuda released patches for them one week before reporting exploitation.
Attackers need access to the targeted device’s administrative interface, Barracuda says.
The company advises customers to apply patches and restrict administrative access to trusted internal networks.
- Who
- Attackers whose identity has not been stated are exploiting the vulnerabilities.
- What
- Two Barracuda product vulnerabilities are being exploited. When combined, they could enable root access.
- When
- Barracuda disclosed exploitation on Monday evening, November 9, according to the articles published November 10, 2026.
- Where
- Barracuda Email Security Gateway and other affected Barracuda products. The affected organizations’ locations are not stated.
- Why
- The attackers’ motive is not stated.
This story does not have two clearly opposing sides.
Barracuda warned that combining the vulnerabilities could allow attackers to bypass authorization controls and obtain root access.
Barracuda released security updates for the two vulnerabilities.
Barracuda updated its advisory to report exploitation affecting a small number of organizations.
- CVE-2026-116606
- CVSS 9.3; pre-authentication authorization bypass in ESG
- CVE-2026-111560
- CVSS 8.6; command-injection flaw affecting multiple Barracuda products
- Affected organizations
- A small number, according to Barracuda
- ESG patch
- BNSF-40425 for version 9.4.017 and later; BNSF-40430 for earlier versions
- Other affected products
- ADC, BMA, WAF, WCC and WSG
3 sources
What people are saying
worked directly
Successful exploitation requires an attacker to have access to the administrative interface of an affected product. If exploited in combination, these vulnerabilities could allow an attacker to bypass authorization controls and obtain root access to the device,
We have identified exploitation activity affecting a small number of organizations,
If your Email Security Gateway's admin UI is open to the internet, that's the first thing I'd close today.