Recently Patched Barracuda Vulnerabilities Exploited in Attacks

Barracuda has confirmed that two recently patched security flaws in its Email Security Gateway and related appliances are now being actively exploited in the wild, with attacks recorded within days of the company's public advisory. SecurityWeek's report details how threat actors are chaining the two bugs to strip away authorization controls and seize root-level access to affected devices.

This article covers both CVEs, the six Barracuda product lines at risk, the CISA mandate requiring federal agencies to patch within three days, and the specific attack telemetry that cybersecurity firm Previdian has published — giving network defenders everything they need to assess exposure and act.

01Authentication Bypass and Root Command Injection Pair

The first vulnerability, CVE-2026-116606, carries a CVSS score of 9.3 and is classified as an authentication bypass in Barracuda Email Security Gateway. An attacker who can reach the administrative user interface can exploit the bug to restore a crafted backup archive and alter the appliance's configuration without valid credentials.

The second flaw, CVE-2026-111560, scores 8.6 and is a command injection weakness. Unlike the first bug, it requires administrative access to trigger, but once an attacker has that foothold — legitimately or through the bypass — they can inject operating system commands that execute with root privileges.

Barracuda warned on November 2 that "if exploited in combination, these vulnerabilities could allow an attacker to bypass authorization controls and obtain root access to the device." The chained attack path makes the pairing significantly more dangerous than either flaw in isolation.

02Six Barracuda Products Carrying the Injection Flaw

CVE-2026-111560 is not limited to the Email Security Gateway. Barracuda confirmed the command injection weakness affects five additional product lines: the Load Balancer Application Delivery Controller (ADC), Web Application Firewall (WAF), Web Security Gateway (WSG), Message Archiver (BMA), and WAF Control Center (WCC).

Organizations running any of those six products with an administrative interface reachable from the internet face elevated risk. The breadth of the affected portfolio means the exposure spans network load balancing, web application filtering, secure browsing, email archiving, and centralized firewall management in a single advisory.

Barracuda has not publicly detailed what versions are specifically vulnerable or what exact configuration conditions raise or lower risk, so all deployments of the listed appliances should be treated as potentially exposed until patches are confirmed applied.

03Active Exploitation and CISA's Three-Day Federal Deadline

A week after the November 2 advisory, Barracuda updated its guidance to warn that threat actors had already begun exploiting both CVEs against a small number of organizations. The US Cybersecurity and Infrastructure Security Agency responded by adding CVE-2026-116606 and CVE-2026-111560 to its Known Exploited Vulnerabilities catalog on Tuesday, November 11.

CISA's addition triggers Binding Operational Directive 26-04, which requires all US federal agencies to apply patches within three days of the KEV listing. That deadline places federal network teams under immediate pressure to verify patch status across every affected Barracuda appliance in their environments.

Neither Barracuda nor CISA has released technical details about the specific intrusions observed, leaving defenders without indicators of compromise from official sources as of the time of this report.

04Previdian's Attack Telemetry: 17 Attempts, 15 IPs, Three Countries

While official sources have stayed quiet on exploitation specifics, cybersecurity firm Previdian has shared concrete telemetry. Between November 9 and November 11 — a 48-hour window — Previdian observed 17 exploitation attempts targeting CVE-2026-116606, the authentication bypass carrying the 9.3 CVSS score.

Those 17 attempts originated from 15 distinct IP addresses spread across three countries. The distribution across multiple source IPs and geographies suggests coordinated scanning or multiple independent threat actors probing for exposed administrative interfaces rather than a single targeted campaign.

The data points to opportunistic exploitation at scale. Appliances with Admin UI ports exposed to the public internet are the primary target surface, and the volume of attempts within the first two days of publicly known exploitation indicates attackers are moving quickly to find unpatched systems.

05Recommended Hardening Steps for All Deployments

Barracuda and CISA are both advising all organizations — not just federal agencies — to update affected products as soon as possible. The remediation guidance pairs patching with network-level hardening: administrative interfaces must not be reachable from the internet and should be restricted exclusively to trusted internal networks.

That network segmentation step addresses the attack surface for CVE-2026-116606 directly, since the authentication bypass requires access to the Admin UI to trigger. Blocking external access to those management ports does not eliminate the need to patch but significantly raises the bar for remote exploitation while teams schedule maintenance windows.

Organizations should audit firewall rules and access control lists governing Barracuda admin ports across all six affected product lines before confirming that patching alone is sufficient. Any interface previously exposed to public IP ranges should be treated as potentially compromised pending investigation.