Barracuda’s email security gateways bitten by make-me-root vulns
Security company Barracuda warns that attackers are exploiting a pre-authentication authorization bypass bug and a command-injection vulnerability in its popular Email Security Gateway (ESG) products that, when chained, could allow the crims to run commands with root privileges.
We have identified exploitation activity affecting a small number of organizations," the security vendor said in a late Monday night update to its earlier security advisory.
Barracuda declined to answer The Register's questions, including one about how many organizations have been hit by attackers. A company spokesperson told us that it worked directly" with the affected businesses to quickly address the issue. Barracuda acted promptly to remediate the vulnerabilities, releasing patches for affected products."
The vendor disclosed and fixed the vulnerabilities, CVE-2026-116606 and CVE-2026-111560, last week.
CVE-2026-116606 is a 9.3 CVSS-rated, pre-authentication authorization bypass flaw in ESG. While authentication is not required to exploit this vulnerability, the attacker must have access to the administrative user interface.
As Purplecop Security founder Tausif Ahmed said on Tuesday: If your Email Security Gateway's admin UI is open to the internet, that's the first thing I'd close today."
CVE-2026-111560 is an 8.6-rated command-injection flaw that affects multiple Barracuda products: its ESG, load balancer (ADC), message archiver (BMA), web application firewall (WAF), WAF control center (WCC), and web security gateway (WSG).
If exploited in combination, these vulnerabilities could allow an attacker to bypass authorization controls and obtain root access to the device," Barracuda warned on November 2. At the time, the vendor did not report any active exploitation of either.
We don't yet know who is responsible for the attacks, or whether the intruders gained root access - but if they did, they could steal data, install backdoors, and take full control of affected systems.
These types of edge-device exploits have been used by Chinese-government spies, and in 2023 the FBI blamed PRC-linked attackers for a series of attacks that targeted Barracuda ESGs to deploy custom malware and maintain access to high-value networks. According to Mandiant, 27 percent of identified affected organizations were government entities.
So if you haven't already: patch now. (R)