Recently Patched Barracuda Vulnerabilities Exploited in Attacks
Source SecurityWeek
Mentioned vulnerabilities
Rated High by Threat Radar's AI analysis
Data as of 11 Nov 2026, 08:03 UTC
What to do
AI-suggested
Barracuda has released patches addressing these vulnerabilities. Organizations must apply these updates immediately to remediate the flaws. Additionally, administrative interfaces should not be exposed to the internet and must be restricted to trusted internal networks only. CISA mandates patching within three days for federal agencies due to active exploitation. No alternative mitigations or workarounds have been specified.
Description
Two recently patched vulnerabilities in Barracuda appliances allow attackers to bypass authorization and gain root access. CVE-2026-116606 is an authentication bypass in Barracuda Email Security Gateway that lets an attacker with Admin UI access restore a crafted backup to modify configurations. CVE-2026-111560 is a command injection flaw affecting multiple Barracuda products, enabling an attacker with administrative access to execute OS commands as root. These vulnerabilities have been exploited in the wild against a small number of organizations. CISA has added both to its Known Exploited Vulnerabilities catalog and urges rapid patching.