Barracuda has confirmed that attackers are exploiting two recently patched vulnerabilities, CVE-2026-116606 and CVE-2026-111560, in a chain that gives them root access on its security appliances, and CISA has added both flaws to its Known Exploited Vulnerabilities catalog.
The confirmation is a material development from the initial disclosure, which came with patches earlier in the month. Barracuda updated its advisory to say exploitation affects “a small number of organizations.”
How the Two Barracuda Flaws Chain Into Root Access
CVE-2026-116606 has a CVSS score of 9.3. It is an authentication flaw in the Email Security Gateway that allows an attacker to restore crafted backup archives and change the global configuration. CVE-2026-111560 scores 8.6 and is an OS command injection flaw that executes with root privileges. It also affects the other products on the advisory list.
Chained together, the two bypass authorization and deliver root. According to the reporting on the attacks, both bugs require access to the administrative user interface, which narrows the exposure to appliances whose management interface can be reached by the attacker.
Affected Barracuda Products and Patch Identifiers
The affected products are Barracuda Email Security Gateway, Load Balancer ADC, Web Application Firewall, Web Security Gateway, Message Archiver and WAF Control Center. Patches shipped in the first days of the month under the identifiers BNSF-40425, BNSF-40430, BNADC-16586, BNMA-32468, BNWF-60060 and BNYF-24789. Barracuda’s advisory says its normal auto-update mechanism applies the patches to connected appliances.
What the Exploitation Data Shows
Security firm Previdian observed 17 exploitation attempts from 15 IP addresses across three countries. That is a limited footprint, consistent with Barracuda’s statement that only a small number of organizations are affected. Small numbers do not mean low risk, since the observed attacks produce root-level control of an appliance that sits in the mail or traffic path.
CISA Sets a Three-Day Deadline Under BOD 26-04
CISA added the flaws to its catalog and set a three-day remediation deadline for federal agencies under Binding Operational Directive 26-04. The short window reflects confirmed exploitation and the privileged position of these devices on the network edge.
Historical Parallel: Barracuda Appliances Have Been Targeted Before
Security appliances that inspect email and web traffic have drawn sustained attacker attention. Analysts have pointed to the 2023 campaigns by the UNC4841 cluster against Barracuda email gateways as the closest precedent. The comparison shows that these boxes combine deep network visibility with administrative interfaces and often receive less endpoint monitoring than servers or workstations.
The current campaign differs in scale: Previdian’s count of 17 attempts is modest, and Barracuda describes the affected population as small. What the two episodes share is the target class and the attackers’ interest in gaining persistent root access on a trusted gateway.
For organizations that rely on auto-update, the patches should already be in place, but defenders cannot assume that. Confirming that each of the listed products is running the fixed build, and confirming that administrative interfaces are not exposed to untrusted networks, are the checks that matter. Because the exploit chain begins at the admin interface, restricting who can reach it removes the precondition for both flaws even before patch status is verified.
Authorization Bypass Plus Command Injection: Why the Chain Works
The chain illustrates how two moderately scoped flaws combine into a more serious one. The authentication flaw in the Email Security Gateway lets an attacker restore crafted backup archives and change the global configuration, which supplies the access needed to reach the command injection flaw. The command injection then executes with root privileges, and Barracuda lists it as affecting the other products on the advisory as well.
Because both bugs need access to the admin interface, the first line of defense is restricting who can reach that interface, which complements installing the patches Barracuda shipped on November 2 and 3.
