Recently Patched Barracuda Vulnerabilities Exploited in Attacks
Threat actors have started exploiting two recently patchedBarracuda vulnerabilitiesthat could be chained to bypass authorization controls and gain root access.
Tracked as CVE-2026-116606 (CVSS score of 9.3), the first bug is described as an authentication bypass in Barracuda Email Security Gateway (ESG).
An attacker with access to the administrative user interface (Admin UI) could trigger it to restore a crafted backup archive and modify the appliance’s configuration.
The second flaw, CVE-2026-111560 (CVSS score of 8.6), is a command injection weakness affecting Barracuda ESG, Load Balancer Application Delivery Controller (ADC), Web Application Firewall (WAF), Web Security Gateway (WSG), Message Archiver (BMA), and WAF Control Center (WCC).
An attacker with administrative access to a vulnerable appliance could exploit the security hole to inject OS commands that would be executed with root privileges.
“If exploited in combination, these vulnerabilities could allow an attacker to bypass authorization controls and obtain root access...
Copyright of this story solely belongs to www.securityweek.com. To see the full text click HERE
