Attackers exploit patched Barracuda flaws, CISA adds to KEV

This is a new development in a story we reported earlier: Barracuda patches flaws allowing root access to appliances.

Two recently patched Barracuda flaws are under active exploitation, with attackers chaining them to defeat authorization and gain root access, and CISA has added the vulnerabilities to its Known Exploited Vulnerabilities catalog on Tuesday. The KEV listing triggers a three-day federal patching deadline under BOD 26-04, and Barracuda announced on the evening of November 9 that exploitation was confirmed. The company said a small number of organizations were affected. Barracuda’s advisory does not identify the intruders, the affected organizations, any malware, or the exact victim count.

The flaws, tracked as CVE-2026-116606 and CVE-2026-111560, were disclosed by Barracuda in early November. Barracuda warned on November 2 that chaining the vulnerabilities could allow an attacker to circumvent authorization and take administrator-level control of the appliance. Mandiant assigned both CVE identifiers, giving the authentication bypass a score of 9.3 out of 10 and the command injection a score of 8.6. Barracuda classifies both flaws as High severity, and its advisory acknowledges the combined root-access risk while omitting exploit requests and a detailed attack sequence.

CVE-2026-116606 carries a CVSS score of 9.3 and is an authentication bypass affecting Barracuda’s Email Security Gateway appliance. CVE-2026-111560, scored at 8.6, is a command injection flaw that allows an administrator to run OS-level commands with root privileges. “If exploited in combination, these vulnerabilities could allow an attacker to bypass authorization controls and obtain root access to the device,” Barracuda stated.

The command injection flaw impacts six Barracuda products: Email Security Gateway, Load Balancer Application Delivery Controller, Web Application Firewall, Web Security Gateway, Message Archiver, and WAF Control Center. The authentication bypass affects only the Email Security Gateway, and that gateway is the sole product impacted by both vulnerabilities.

Barracuda clarified on November 5 that an attacker must reach the appliance’s administrative interface to exploit the vulnerabilities, though no credentials are needed. “Successful exploitation requires an attacker to have access to the administrative interface of an affected product,” the company noted. The interface must be reachable by the attacker.

Previdian logged 17 exploit attempts targeting CVE-2026-116606 between November 9 and November 11, coming from 15 IP addresses across three countries. watchTowr outlined the attack sequence and released a detection tool for vulnerable appliances, but has not published an exploit.

Barracuda has issued patches for all affected products. For the Email Security Gateway, the fix arrives as version 9.4.0.030 or later. Organizations running releases numbered 9.4.017 or newer should apply patch BNSF-40425, while earlier releases use patch BNSF-40430. The Load Balancer Application Delivery Controller and Web Application Firewall are fixed through BNADC-16586. Message Archiver needs BNMA-32468, WAF Control Center needs BNWF-60060, and Web Security Gateway needs BNYF-24789.

Appliances several versions behind may need more than one update; administrators should manually apply any missing patches and re-enable automatic patching if it is turned off. Barracuda recommends deploying updates promptly, keeping administrative interfaces away from the internet, restricting access to trusted internal networks, ensuring firmware is current, and enabling automatic patching.

The current exploitation comes three years after Barracuda fixed Email Security Gateway flaw CVE-2023-7102, which UNC4841 weaponized as a zero-day to execute arbitrary code on unpatched appliances. Barracuda said attackers exploited the flaw for a minimum of seven months starting in October 2022, deploying SeaSpy and Saltwater malware to exfiltrate data. Mandiant reported that almost one-third of the appliances compromised during the 2023 campaign belonged to government agencies globally, with the majority of breaches occurring between October and December 2022. During that same period, UNC4841 leveraged a separate zero-day, CVE-2023-2868, to target Barracuda Email Security Gateway appliances in cyber-espionage operations.

Barracuda, established in 2003, counts more than 200,000 customers globally, ranging from small and medium businesses to large enterprises and managed service providers.