Barracuda warns of exploited make-me-root flaws in Email Security Gateways

Security company Barracuda warns that attackers are exploiting a pre-authentication authorization bypass bug and a command-injection vulnerability in its Email Security Gateway products. The two flaws, when chained, could allow attackers to run commands with root privileges. Barracuda said a late Monday night update identified exploitation activity affecting a small number of organizations.

What Barracuda disclosed

Barracuda declined to answer questions about the incidents, including how many organizations were hit. A company spokesperson said it worked directly with affected businesses and released patches for affected products. The vendor disclosed and fixed CVE-2026-116606 and CVE-2026-111560 last week. CVE-2026-116606 is a 9.3 CVSS-rated pre-authentication authorization bypass flaw in ESG; authentication is not required, but the attacker must have access to the administrative user interface. CVE-2026-111560 is an 8.6-rated command-injection flaw affecting ESG, load balancer (ADC), message archiver (BMA), web application firewall (WAF), WAF control center (WCC), and web security gateway (WSG).

Risk if the flaws are chained

Barracuda warned on November 2 that if exploited in combination, the vulnerabilities could allow an attacker to bypass authorization controls and obtain root access to the device. At that time, the vendor did not report active exploitation of either flaw. It is not yet known who is responsible for the attacks, or whether intruders gained root access. If they did, they could steal data, install backdoors, and take full control of affected systems.

Links to earlier attacks

These types of edge-device exploits have been used by Chinese-government spies. In 2023, the FBI blamed PRC-linked attackers for attacks targeting Barracuda ESGs to deploy custom malware and maintain access to high-value networks. According to Mandiant, 27 percent of identified affected organizations were government entities.

Advice for administrators

Purplecop Security founder Tausif Ahmed said on Tuesday that if an Email Security Gateway admin interface is open to the internet, that is the first thing to close. Barracuda's closing advice was to patch now.

Sources: The Register