# Barracuda Email Security Gateways Exploited via Root-Level Vulnerabilities Attackers chain two critical flaws to gain unauthorized root access on Barracuda devices. - **Source:** [www.theregister.com - Articles](https://brifing.si/source/2c34ea50-d341-4a10-925d-12c012a9ad10) - **Published:** 2026-11-10 - **Topic:** [technology](https://brifing.si/c/technology) - **Original article:** - **On Brifing:** https://brifing.si/s/b2633d4f-0d8e-4f3c-84cc-a70870872b49 ## Critical Vulnerability Chaining Barracuda has confirmed that attackers are actively exploiting two vulnerabilities within its Email Security Gateway products. By chaining a pre-authentication authorization bypass, identified as CVE-2026-116606, with a command-injection flaw, CVE-2026-111560, malicious actors can execute commands with root privileges. This combination allows unauthorized users to bypass security controls and gain full control. ## Scope of Affected Products While the authorization bypass specifically impacts the Email Security Gateway, the command-injection flaw affects a broader range of Barracuda hardware. Vulnerable systems include the load balancer, message archiver, web application firewall, and web security gateway. Organizations utilizing these edge devices are currently at risk if they have not applied the necessary patches. ## Active Exploitation Confirmed Barracuda reported that a small number of organizations have already been targeted by these exploits. Although the company declined to specify the exact number of victims, they confirmed they are working directly with affected clients. The vendor released patches last week to remediate the flaws, urging all customers to update immediately. ## Administrative Interface Risks Security experts emphasize that the primary risk factor is the exposure of the administrative user interface to the internet. Tausif Ahmed, founder of Purplecop Security, advised administrators to restrict access to these interfaces immediately. Since the authorization bypass does not require authentication, any exposed admin UI serves as a direct entry point. ## Potential Impact of Compromise If attackers successfully achieve root access, they gain the ability to steal sensitive data, install persistent backdoors, and manipulate system configurations. Such deep access allows intruders to maintain long-term presence within high-value networks. The full extent of the damage in currently compromised organizations remains unknown, as investigations into the attackers' activities continue. ## Historical Context of Attacks Edge devices like Barracuda gateways are frequent targets for state-sponsored espionage groups. In 2023, the FBI attributed similar attacks on Barracuda infrastructure to PRC-linked actors who deployed custom malware. Historical data from Mandiant shows that 27 percent of previously affected organizations were government entities, highlighting the high-value nature of these specific targets. ## Vendor Response and Remediation Barracuda disclosed the vulnerabilities on November 2 and acted promptly to provide software updates. The company maintains that it is working to address the issue for all impacted businesses. Despite the urgency, the identity of the attackers responsible for this current wave of exploitation has not yet been determined by the vendor. ## Urgent Security Recommendations The immediate priority for all IT administrators is to apply the provided patches to all affected Barracuda appliances. Beyond patching, organizations should audit their network perimeters to ensure administrative interfaces are not publicly accessible. Given the history of targeted attacks on these devices, proactive hardening of edge infrastructure is essential for defense. ## Sources covering this story - https://www.theregister.com/security/2026/11/10/barracudas-email-security-gateways-bitten-by-make-me-root-vulns/5308883 — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._