THE CRUNCH
Barracuda has warned that attackers are exploiting two vulnerabilities in its Email Security Gateway (ESG) appliances, which when chained together could hand intruders root access to the device. The vendor disclosed and patched the flaws, CVE-2026-116606 and CVE-2026-111560, last week, and in a late Monday update to its advisory said: "We have identified exploitation activity affecting a small number of organizations."
The first flaw, CVE-2026-116606, is a 9.3 CVSS-rated pre-authentication authorization bypass in ESG. No login is needed to exploit it, but the attacker does need to reach the administrative interface. The second, CVE-2026-111560, is an 8.6-rated command-injection bug, and it affects a wider range of products: ESG, the ADC load balancer, BMA message archiver, WAF and WCC web application firewalls, and the WSG web security gateway.
When Barracuda disclosed the pair on November 2 it reported no active exploitation. It has since confirmed attacks but declined to say how many organisations were hit, telling The Register only that it "worked directly" with affected businesses and released patches promptly. It is not yet known who is behind the attacks or whether root access was actually obtained.
There is uncomfortable history here. In 2023 the FBI blamed PRC-linked attackers for a campaign against Barracuda ESGs that deployed custom malware to maintain access to high-value networks, and Mandiant found 27 percent of identified affected organisations were government entities. Edge-device exploits of this kind have been a staple of state-sponsored spying.
The practical advice is blunt. As Purplecop Security founder Tausif Ahmed put it on Tuesday: "If your Email Security Gateway's admin UI is open to the internet, that's the first thing I'd close today." Patching is the other obvious step.
Earlier on this story
Crunchy Tech briefs on this story.