Attackers Exploit Recently Patched Barracuda Vulnerabilities

Threat actors have begun exploiting two recently patched security flaws in Barracuda enterprise appliances that allow attackers to chain vulnerabilities, bypass authorization controls, and gain root access. The weaknesses affect products including Barracuda Email Security Gateway (ESG), Load Balancer ADC, Web Application Firewall (WAF), Web Security Gateway, Message Archiver, and WAF Control Center. The US Cybersecurity and Infrastructure Security Agency (CISA) has added both defects to its Known Exploited Vulnerabilities catalog. Malaysian organisations managing affected appliances should verify their administrative interfaces are restricted and report any suspected security breaches to Cyber999.

Key Facts

How Do the Vulnerabilities Work Together?

An attacker with administrative interface access triggers CVE-2026-116606 to restore a crafted backup archive on Barracuda Email Security Gateway, bypassing authentication controls. The attacker can then exploit CVE-2026-111560 to inject operating system commands across vulnerable appliances, executing malicious commands with root privileges to take full control of the appliance.

CVE-2026-116606 carries a CVSS score of 9.3 and functions as an authentication bypass flaw within the administrative user interface, permitting attackers to alter appliance configurations. Concurrently, CVE-2026-111560 carries a CVSS score of 8.6 as a command injection weakness spanning multiple Barracuda product lines, including Load Balancer ADC, WAF, Web Security Gateway, Message Archiver, and WAF Control Center.

Chaining these two security defects enables an attacker to bypass authorization controls and obtain root access to the device.

Is Active Exploitation Underway in the Wild?

Yes, active exploitation has been confirmed against a small number of organisations. Barracuda updated its advisory to warn of live attacks, prompting CISA to add both vulnerabilities to its Known Exploited Vulnerabilities catalog. Furthermore, cybersecurity firm Previdian observed 17 exploitation attempts targeting CVE-2026-116606 between 9 November and 11 November.

The exploitation attempts recorded by Previdian originated from 15 IP addresses across three countries. In response to the active threat, CISA mandated under Binding Operational Directive (BOD) 26-04 that US federal civilian agencies apply updates within three days. Neither Barracuda nor CISA has publicly shared detailed technical information regarding the specific threat actors involved.

Previdian recorded 17 exploitation attempts against CVE-2026-116606 originating from 15 IP addresses across three countries between 9 November and 11 November.

What Should You Do?

• Update affected Barracuda products as soon as possible by applying the latest official vendor updates.
• Ensure that administrative user interfaces (Admin UI) are not exposed to the public internet.
• Restrict administrative access strictly to trusted internal networks.
• Report suspected compromise or related cyber incidents within Malaysia to the Cyber999 Incident Handling Centre operated by MyCERT.

Common Questions

Which Barracuda appliances are affected by these vulnerabilities?

CVE-2026-116606 affects Barracuda Email Security Gateway (ESG). CVE-2026-111560 affects ESG, Load Balancer Application Delivery Controller (ADC), Web Application Firewall (WAF), Web Security Gateway (WSG), Message Archiver (BMA), and WAF Control Center (WCC).

What access does an attacker need to exploit the flaws?

An attacker requires access to the appliance's administrative user interface. From there, the attacker can restore a crafted backup archive to modify configurations and inject commands that execute with full root privileges.

What deadline has CISA set for remediating these flaws?

The US cybersecurity agency CISA added both vulnerabilities to its Known Exploited Vulnerabilities catalog, requiring federal civilian agencies to apply patches within three days under the requirements of Binding Operational Directive (BOD) 26-04.

Sources and Methodology

This dispatch is based solely on reporting published by SecurityWeek (Recently Patched Barracuda Vulnerabilities Exploited in Attacks). This dispatch was compiled strictly from the provided source text without independent verification or external research.