securityweek.com
Negativesecurityweek.com · · US
Recently Patched Barracuda Vulnerabilities Exploited in Attacks
Executive Summary
AI-generatedThreat actors are actively exploiting two recently patched Barracuda vulnerabilities, CVE-2026-116606 and CVE-2026-111560. These flaws include an authentication bypass and a command injection weakness, which, when combined, could allow attackers to gain root access to the devices. CISA has added both vulnerabilities to its Known Exploited Vulnerabilities catalog, urging federal agencies to apply patches immediately.
Key Insights
- Two critical Barracuda vulnerabilities are currently being exploited in active attacks.
- CVE-2026-116606 is an authentication bypass flaw in the Barracuda Email Security Gateway (ESG) with a CVSS score of 9.3.
- CVE-2026-111560 is a command injection weakness affecting multiple Barracuda appliances, including WAF and ADC, with a CVSS score of 8.6.
- The combination of these two vulnerabilities could enable an attacker to bypass authorization and achieve root access.
- CISA has officially listed both CVEs in its Known Exploited Vulnerabilities catalog, mandating swift patching for federal agencies.
- Security firm Previdian has documented 17 exploitation attempts targeting CVE-2026-116606 in early November.
The full article is on the original publisher site.