InfoSecBulletin Cybersecurity for mankind
Barracuda has confirmed active exploitation of security flaws affecting its Email Security Gateway (ESG), warning that attackers could combine two vulnerabilities to gain root access without logging in.
The issues, listed as CVE-2026-116606 and CVE-2026-111560, include an authorization bypass and command injection. To exploit them, one needs access to the device’s admin interface. This condition makes exposed management pages a key concern, although Barracuda says organizations with interfaces kept off the public internet are less exposed to this attack path.
Barracuda ESG flaws exploited, gaining root access
Apple, SAP, and Ivanti Patch Critical flaws Affecting Messaging, Bluetooth, and Enterprise Systems
Jailbroken DeepSeek AI Agent Conducts Two-Week Cyberattack on European Telecom
Daily Cyber security update for 10.11. 2026
IBM fixes 208 API Connect vulnerabilities, 47 critical
89 New ransomware groups emerge in 2026, claiming over 2,200 victims
Daily Cyber security update for 08.11. 2026
Japan banking crisis
Outage causes disruption at 128 japan banks: preventing ATM transaction
Daily Cyber security update for 06.11. 2026
Cyber attack causes French bank Credit Mutuel Arkea €100 million missing
Barracuda Email Gateway Flaws
CVE-2026-116606 is a security flaw that lets attackers bypass authorization in ESG. It has a CVSS score of 9.3. On November 5, Barracuda updated its advisory to explain that attackers do not need valid credentials. They need to access the admin user interface. So, network access and logged-in access are two different needs.
CVE-2026-111560 is a command injection issue that has a CVSS score of 8.6. By itself, it needs admin access. But if it is used with the authorization bypass, it can get rid of the login barrier and give root access to the device.
ESG is the only listed product affected by both vulnerabilities, so the unauthenticated chain should not be assumed to affect every listed product. According to Barracuda’s updated security advisory, both flaws carry a vendor severity rating of High. Its public guidance confirms the combined root-access risk but does not provide exploit requests or a detailed attack sequence.
This makes it hard for defenders to understand the methods used in the incidents. ESG customers need patch BNSF-40425 for versions 9.4.017 and newer, or BNSF-40430 for older versions. The command injection problem also affects Load Balancer Application Delivery Controller and Web Application Firewall, fixed through BNADC-16586.
Message Archiver needs BNMA-32468, WAF Control Center needs BNWF-60060, and Web Security Gateway needs BNYF-24789. These products have different jobs, so keeping correct device lists is key when looking at patch coverage.
Barracuda says to limit admin access to trusted internal networks and use proper network controls. Customers should check that they have the latest firmware and all necessary security updates. Devices that are several versions old might require multiple updates. Manually install missing patches and turn on automatic updates where it’s off.
