Hackers Exploit Newly Patched Barracuda Flaws

Threat actors are exploiting two recently patched Barracuda vulnerabilities against a small number of organizations, according to the company. The flaws can be chained to bypass authorization controls and gain root access to affected appliances.

Barracuda disclosed the vulnerabilities on Nov. 2 and updated its advisory about a week later to warn that attackers had begun exploiting them. CISA added both flaws to its Known Exploited Vulnerabilities catalog on Tuesday.

The first vulnerability, CVE-2026-116606, has a CVSS severity score of 9.3 and affects Barracuda Email Security Gateway. An attacker with access to the product’s administrative interface could use a crafted backup archive to restore altered settings and change the appliance’s configuration.

The second flaw, CVE-2026-111560, has a CVSS score of 8.6 and is a command-injection vulnerability. It affects Barracuda Email Security Gateway, Load Balancer Application Delivery Controller, Web Application Firewall, Web Security Gateway, Message Archiver and WAF Control Center. An attacker with administrative access could inject operating-system commands that run with root privileges.

“If exploited in combination, these vulnerabilities could allow an attacker to bypass authorization controls and obtain root access to the device,” Barracuda wrote in its advisory.

CISA is requiring federal agencies to apply the available fixes within three days under Binding Operational Directive 26-04. Barracuda and CISA have not released details about the attacks or identified the affected organizations.

Cybersecurity firm Previdian recorded 17 attempts to exploit CVE-2026-116606 between Nov. 9 and Nov. 11. The attempts came from 15 IP addresses across three countries.

Organizations using the affected Barracuda products should install the available updates and ensure that administrative interfaces are not accessible from the public internet. Barracuda recommends restricting access to trusted internal networks.