Barracuda’s advisory and the patch rollout
Barracuda disclosed and fixed two vulnerabilities last week and issued a late Monday-night update confirming exploitation activity against a “small number of organizations.” The vendor said it “worked directly” with affected businesses “to quickly address the issue” and that it “acted promptly to remediate the vulnerabilities, releasing patches for affected products.” The Register’s request for details, including how many organizations have been hit, was declined by Barracuda.
CVE-2026-116606: pre-auth authorization bypass in the ESG
The more severe of the two flaws, CVE-2026-116606, carries a 9.3 CVSS rating and is described as a pre-authentication authorization bypass in Barracuda’s Email Security Gateway. Although the vulnerability does not require standard authentication, exploiting it does require access to the ESG administrative user interface. Purplecop Security founder Tausif Ahmed summed up the immediate mitigation bluntly: “If your Email Security Gateway's admin UI is open to the internet, that's the first thing I'd close today.”
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleCVE-2026-111560: command injection across multiple Barracuda products
The second flaw, CVE-2026-111560, is an 8.6-rated command-injection vulnerability that affects multiple Barracuda products: the Email Security Gateway (ESG), the Application Delivery Controller/load balancer (ADC), the Message Archiver (BMA), the Web Application Firewall (WAF), the WAF Control Center (WCC), and the Web Security Gateway (WSG). Barracuda warned on November 2 that “if exploited in combination, these vulnerabilities could allow an attacker to bypass authorization controls and obtain root access to the device.” At the time of that warning, the vendor did not report any active exploitation.
Observed exploitation, potential impact, and attribution status
While Barracuda’s update confirms active exploitation, the company said only that a “small number of organizations” were affected and declined to quantify the scope. The Register and Barracuda did not report whether intruders achieved root access on targeted systems. If root access were obtained, Barracuda noted the consequences: attackers could steal data, install backdoors, and take full control of affected systems.
The source material also notes precedent: “These types of edge-device exploits have been used by Chinese-government spies,” and, in 2023, the FBI blamed PRC-linked attackers for attacks that targeted Barracuda ESGs to deploy custom malware and maintain access to high-value networks. Mandiant reported that 27 percent of identified affected organizations in that earlier activity were government entities.
What this means for government entities, security teams, and adversaries
- Government entities: Mandiant’s prior analysis found that 27 percent of affected organizations were government bodies; that historical footprint underscores why the vendor’s confirmation of “a small number of organizations” being exploited is especially consequential for public-sector networks.
- Security teams and IT/ops: Barracuda released patches last week and said it worked directly with affected customers. Immediate, story-specific actions cited in the coverage include applying the vendor patches and, where the ESG admin UI is exposed, closing that interface to the internet — a recommendation explicitly voiced by Tausif Ahmed.
- Adversaries and threat actors: Barracuda’s technical warning is stark — an authorization bypass and a command-injection flaw, when chained, “could allow an attacker to bypass authorization controls and obtain root access.” That combination presents an operational path to full device takeover if exploitation is successful.
Barracuda’s confirmation of active exploitation, the high CVSS scores for both CVEs (9.3 and 8.6), and the vendor’s immediate patching together form the hard facts of this episode. What remains open — and will determine how damaging this episode ultimately is — is whether intruders achieved root on any devices, the identities or motivations of the attackers, and how many organizations were quietly remediated as Barracuda “worked directly” with victims.
So, in the words that closed the original coverage: if you haven’t already: patch now.
