Barracuda Email Security Gateways Exploited via Root-Level Vulnerabilities
Attackers chain two critical flaws to gain unauthorized root access on Barracuda devices.
1Critical Vulnerability Chaining
Barracuda has confirmed that attackers are actively exploiting two vulnerabilities within its Email Security Gateway products. By chaining a pre-authentication authorization bypass, identified as CVE-2026-116606, with a command-injection flaw, CVE-2026-111560, malicious actors can execute commands with root privileges. This combination allows unauthorized users to bypass security controls and gain full control.
2Scope of Affected Products
While the authorization bypass specifically impacts the Email Security Gateway, the command-injection flaw affects a broader range of Barracuda hardware. Vulnerable systems include the load balancer, message archiver, web application firewall, and web security gateway. Organizations utilizing these edge devices are currently at risk if they have not applied the necessary patches.
3Active Exploitation Confirmed
Barracuda reported that a small number of organizations have already been targeted by these exploits. Although the company declined to specify the exact number of victims, they confirmed they are working directly with affected clients. The vendor released patches last week to remediate the flaws, urging all customers to update immediately.
4Administrative Interface Risks
Security experts emphasize that the primary risk factor is the exposure of the administrative user interface to the internet. Tausif Ahmed, founder of Purplecop Security, advised administrators to restrict access to these interfaces immediately. Since the authorization bypass does not require authentication, any exposed admin UI serves as a direct entry point.
5Potential Impact of Compromise
If attackers successfully achieve root access, they gain the ability to steal sensitive data, install persistent backdoors, and manipulate system configurations. Such deep access allows intruders to maintain long-term presence within high-value networks. The full extent of the damage in currently compromised organizations remains unknown, as investigations into the attackers' activities continue.
6Historical Context of Attacks
Edge devices like Barracuda gateways are frequent targets for state-sponsored espionage groups. In 2023, the FBI attributed similar attacks on Barracuda infrastructure to PRC-linked actors who deployed custom malware. Historical data from Mandiant shows that 27 percent of previously affected organizations were government entities, highlighting the high-value nature of these specific targets.
7Vendor Response and Remediation
Barracuda disclosed the vulnerabilities on November 2 and acted promptly to provide software updates. The company maintains that it is working to address the issue for all impacted businesses. Despite the urgency, the identity of the attackers responsible for this current wave of exploitation has not yet been determined by the vendor.
8Urgent Security Recommendations
The immediate priority for all IT administrators is to apply the provided patches to all affected Barracuda appliances. Beyond patching, organizations should audit their network perimeters to ensure administrative interfaces are not publicly accessible. Given the history of targeted attacks on these devices, proactive hardening of edge infrastructure is essential for defense.