Critical Barracuda Security Flaws Exploited, Giving Attackers Root Access

Threat actors are now actively exploiting two severe, recently patched vulnerabilities in Barracuda's security appliances. The first flaw, CVE-2026-116606, is an authentication bypass in the Email Security Gateway. The second, CVE-2026-111560, is a command injection flaw affecting several Barracuda products, including Load Balancers, Web Application Firewalls, and Security Gateways. If chained together, these vulnerabilities allow an attacker to bypass authorization controls and gain full root access to the device.

The U.S. cybersecurity agency CISA has added these flaws to its Known Exploited Vulnerabilities catalog, requiring federal agencies to patch them within three days. Security researchers have already observed 17 exploitation attempts from 15 different IP addresses. This incident underscores the critical importance of applying vendor security patches immediately, especially for network security appliances that sit at the perimeter of an organization's defenses.