Barracuda Confirms Active Exploitation of Email Gateway Flaws Allowing Root Access
Barracuda confirms active exploitation of Email Security Gateway flaws enabling unauthenticated root access.
Barracuda has confirmed active exploitation of two vulnerabilities (CVE-2026-116606 and CVE-2026-111560) in its Email Security Gateway that allow attackers to gain root access without logging in by chaining an authorization bypass with command injection. The flaws affect a small number of organizations, and patches are available: BNSF-40425 for ESG versions 9.4.017 and later, or BNSF-40430 for earlier versions, with additional patches for related products. Barracuda recommends restricting administrative interfaces to trusted internal networks and applying all applicable security patches immediately.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Barracuda?
Get an email when a new story names Barracuda, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonAttackers actively exploited two vulnerabilities in Barracuda's Email Security Gateway by chaining an authorization bypass with a command injection flaw, ultimately gaining root-level access without any valid credentials. This combination is especially dangerous because neither vulnerability alone may appear critical, but together they provide full system compromise with no authentication required. The incident highlights the severe risk posed by internet-exposed administrative interfaces on network appliances, which are high-value targets and often overlooked in patch cycles. Organizations running perimeter security appliances must treat them with the same — or greater — urgency as internal systems, applying patches immediately and restricting management access to trusted networks only.
What helps against this
How we list vendors- Vulnerability scanning and prioritisation
You know which systems are vulnerable, and which ones to fix first.
- Automated patch management
Known holes get closed in days, not months.
- Next-generation firewall and intrusion prevention
Malicious traffic is blocked at the network edge and between zones.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- cve — CVE-2026-116606
- cve — CVE-2026-111560