Exploited Barracuda ESG Flaws CVE-2026-116606 Can Be Chained
CISA flags two exploited Barracuda flaws: an ESG auth bypass (CVE-2026-116606) and a root command injection (CVE-2026-111560) that attackers can chain.
⚡ Why it matters
An email gateway sits in front of every message your company receives; controlling it means reading mail or changing security settings. If your organization runs Barracuda appliances, make this today's priority.
On November 10, 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added six vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, including two in Barracuda Networks products.
The two flaws
CVE-2026-116606: an authentication bypass in Barracuda Email Security Gateway (ESG). According to CISA, it may allow an unauthenticated attacker to call the configuration import function and restore a crafted backup file, changing the appliance's global settings.CVE-2026-111560: an OS command injection affecting several products, including ESG, Load Balancer, Web Application Firewall (WAF) and Web Security Gateway. It requires an administrator account but runs commands as root when a crafted time zone value is processed.
CISA warns that the two can be chained: the first opens the door without a password, and the second gives full control of the appliance.
What to do
- Review Barracuda's official advisories and apply the available updates for each product immediately.
- Restrict access to management interfaces and never expose them to the internet.
- Check appliance logs for configuration imports or unexplained time zone changes.
- If you suspect a compromise, treat the appliance as breached: rotate the passwords and keys tied to it and ask the vendor for support.
CISA did not say whether the flaws have been used in ransomware campaigns.
🔗 Sources
This article is original reporting by the Security World editorial team based on the sources listed above; direct quotes are kept short and marked with quotation marks. Corrections and feedback: info [at] securitywd.net.
Related stories
FBI Warns Artex AI Tool Automates Hacks at Machine Speed
The FBI issued a flash alert about Artex, an open-source pentesting platform that plugs any LLM into AI agents that run attack stages automatically. Some intrusions reached privileged access in under three hours.
Xen Orchestra Auth Bypass Exploited to Take Over XCP-ng
French vendor Vates warned that a critical flaw in Xen Orchestra, the management tool for XCP-ng virtualization, is under active exploitation. A crafted cookie bypasses authentication, granting admin rights and root control of hosts.
Cisco BroadWorks and Openwave Flaws Exploited, Added to KEV
On Tuesday, November 10, CISA listed two flaws, one in Cisco BroadWorks and one in Openwave Messaging Webtop Media Transcoder, in its Known Exploited Vulnerabilities (KEV) catalog, even though fixes have been out for months.