Attackers are exploiting two recently patched Barracuda vulnerabilities that can be combined to bypass authorization controls and gain root access to an appliance. SecurityWeek reported that Barracuda confirmed exploitation against a small number of organizations, making updates and restrictions on administrative access an immediate priority for affected operators.
The authentication bypass affects Barracuda Email Security Gateway (ESG). The second vulnerability, an operating-system command injection flaw, affects ESG and several other Barracuda appliance products. CISA added both to its Known Exploited Vulnerabilities catalog on November 10, 2026, with a listed remediation date of November 13 and a requirement for forensic triage in the applicable federal response.
How the vulnerabilities connect
CVE-2026-116606, which carries a CVSS score of 9.3, allows an unauthenticated remote attacker who can reach the ESG administrative user interface to invoke a configuration-import function. By restoring a crafted, compatible backup archive, the attacker can make unauthorized changes to the appliance’s global configuration, CISA’s catalog explains.
The second flaw, CVE-2026-111560, has a CVSS score of 8.6. It affects ESG, Load Balancer/Application Delivery Controller (ADC), Web Application Firewall (WAF), Web Security Gateway (WSG), Message Archiver (BMA) and WAF Control Center (WCC).
Exploiting that flaw requires authenticated administrative access. CISA describes an attacker inserting OS commands into a crafted timezone value; those commands execute with root privileges when the value is subsequently processed.
The prerequisites matter: the authentication bypass concerns ESG, while the command injection has a broader product scope. CISA identifies the two vulnerabilities as chainable, and Barracuda warned on November 2 that combining them could let an attacker bypass authorization controls and obtain root access to a device, SecurityWeek reported.
A week after that warning, Barracuda updated its advisory to acknowledge exploitation against a small number of organizations. Separately, SecurityWeek reported that cybersecurity firm Previdian observed 17 attempts targeting CVE-2026-116606 between November 9 and November 11, originating from 15 IP addresses across three countries.
Those observations count attempts. Barracuda’s acknowledgment and CISA’s catalog entries establish the exploitation concern; the CVSS scores describe severity. CISA lists ransomware campaign use as unknown for both vulnerabilities.
Federal response includes forensic triage
The CISA catalog entries direct covered agencies to apply mitigations following vendor instructions and comply with Binding Operational Directive 26-04 and its forensic triage requirements. They also call for applicable cloud-service guidance to be followed, or use of the product to stop if mitigations are unavailable.
The November 13 catalog date sits within a directive governing U.S. Federal Civilian Executive Branch agencies. Under BOD 26-04, asset-specific response timelines depend on public exposure, KEV status, whether exploitation can be automated and the technical impact. Agencies must evaluate each asset’s exposure; the catalog date is not a universal legal deadline for every organization or appliance.
For the three-day response category, the directive requires remediation or mitigation within that period and forensic triage to assess compromise. Removing a system from the internet can change its exposure classification and the timeline for further action.
CISA’s implementation guidance tells agencies to scope affected systems and preserve evidence before altering or remediating them where possible. Volatile data should be collected first, with collection records maintained, because patching and containment can destroy artifacts needed for analysis.
Agencies should then apply critical patches, coordinate containment with evidence collection, isolate affected or suspected systems and examine evidence for unauthorized access, attacker presence, lateral movement, persistence, and data staging or exfiltration. The guidance’s individual triage target times are recommended practices; performing adequate forensic triage is the requirement.
Administrators running the affected Barracuda products should install the applicable updates promptly. SecurityWeek also advises keeping administrative interfaces off the public internet and restricting access to trusted internal networks. Covered federal agencies should pair the vendor-directed mitigation with the required assessment for compromise.
