Barracuda email gateways hit by attacks chaining two serious flaws

[Kane_Node]

Organisations using Barracuda's email security appliances need to patch quickly. The Register reports that late on 9 November Barracuda updated its advisory to say attackers are exploiting two chained flaws in its Email Security Gateway against a small number of organisations

CVE-2026-116606, rated 9.3 on the CVSS scale, is an authorisation bypass that works before login but needs access to the admin interface. CVE-2026-111560, rated 8.6, is a command injection flaw affecting ESG, ADC, BMA, WAF, WCC and WSG products

Both flaws were patched the week before, and the 2 November advisory said there was no exploitation at that point. Tausif Ahmed of Purplecop Security said that if an Email Security Gateway's admin interface is open to the internet, that is the first thing he would close

Barracuda would not say how many organisations were hit. The attackers are unknown, and it is not clear whether full root access was obtained

Email gateways sit at the edge of a network, which makes them attractive targets. Keeping admin interfaces off the open internet is simple advice that blocks a lot of attacks. Applying patches promptly matters, because the gap between a fix and exploitation can be just days

Does your organisation expose admin interfaces to the internet? And how quickly do you usually apply security patches?

Barracuda's email security gateways bitten by make-me-root vulnswww.theregister.com