Barracuda Networks says attackers have exploited two patched vulnerabilities in its Email Security Gateway (ESG), adding confirmed attack activity to a security advisory first published on November 2. The company updated the advisory on November 9, saying it had identified exploitation affecting a small number of organizations. It did not name the victims, give a count or describe what the attackers accessed.
The flaws are CVE-2026-116606, a pre-authentication authorization bypass with a severity score of 9.3, and CVE-2026-111560, a command-injection vulnerability rated 8.6. Barracuda says the two can be exploited together to bypass authorization controls and obtain root access to an affected device. The attack path still requires access to the product’s administrative interface: CVE-2026-116606 does not require valid credentials, but the Admin UI must be reachable, while CVE-2026-111560 lists administrative access as required, according to Barracuda’s updated security advisory.
Both vulnerabilities affect the Email Security Gateway, while CVE-2026-111560 also affects Barracuda’s Load Balancer ADC, Message Archiver, WAF Control Center, Web Application Firewall and Web Security Gateway. Barracuda lists patches BNSF-40425 for ESG 9.4.017 and later and BNSF-40430 for earlier ESG builds. The other fixes are BNADC-16586 for the ADC and WAF, BNMA-32468 for Message Archiver, BNWF-60060 for WAF Control Center and BNYF-24789 for Web Security Gateway.
The Canadian Centre for Cyber Security’s November 9 update says open-source reporting indicates that CVE-2026-116606 is being exploited in the wild. It lists affected versions before ESG 9.4.0.030, ADC 6.4.0, WAF 11.0.1, WSG 16.1.100.100, Message Archiver 5.5.4.0 and WAF Control Center 2.2.1. Barracuda’s earlier clarification that the authorization-bypass flaw does not require valid login credentials is detailed in the company’s ESG authentication update. The original disclosure of the chained root-access risk is covered in the initial report on the two flaws.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
