Vulnerability · critical · CVSS 9.3
Barracuda Email Security Gateway flaws exploited in the wild
Tier A · Patch today – Before you go home
Who’s exposed: Organizations running Barracuda Email Security Gateway
Tier A because: Core infrastructure or popular tool AND exploited in the wild
Reach
Attack
Damage
Fix
Popular tool · Exploited in the wild · Remote, no login · Full takeover
What to do
- Apply Barracuda's patches for the two recently fixed ESG vulnerabilities.
The Brief
- Barracuda Networks warned that attackers have begun exploiting two recently patched Email Security Gateway (ESG) vulnerabilities.
- The flaws let attackers run commands with root privileges on affected appliances.
- Barracuda describes the flaws as critical, and the attacks are active.
Why it matters
Attackers with root access on an email security gateway could control mail traffic and reach systems behind it. Organizations running affected ESG versions should treat this as an active compromise risk.
The checklist behind the tier
Checklist · 5 of 10 yes
| Yes | Hits tech teams | Judgment: Barracuda Email Security Gateway is a mail security appliance that IT and ops teams run. |
| No | Core infrastructure | Judgment: a single vendor's appliance, not software nearly every team runs. |
| Yes | Popular tool | Judgment: ESG is a widely deployed mail gateway appliance used by many organizations. |
| Yes | Exploited in the wild | BleepingComputer: attackers have begun exploiting two patched ESG vulnerabilities. |
| No | Public exploit | BleepingComputer: sources do not say exploit code or a PoC is published. |
| Yes | Remote, no login | CVSSCVE-2026-116606: CVSS 9.3 – network, no privileges, no user interaction |
| Yes | Full takeover | CVSSCVE-2026-116606: CVSS rates confidentiality and integrity impact high |
| No | Secrets exposed | BleepingComputer: sources do not report stolen credentials, configs or data. |
| No | Supply chain | BleepingComputer: flaws are in the product itself, not a compromised package or update channel. |
| No | No fix yet | BleepingComputer: the two vulnerabilities were already patched. |
The official record
From CVE.org, CISA’s Known Exploited Vulnerabilities catalog, FIRST EPSS and the GitHub Advisory Database. Where these answer a checklist fact, they win over the reporting.
CVE-2026-116606 ↗CVSS 9.3 critical AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Authentication Bypass Allows Global Configuration Restore in Barracuda Email Security Gateway
- Exploited
- Not in CISA’s exploited catalog
- EPSS
- 1.6% chance of exploitation in the next 30 days · higher than 76% of all CVEs
- Weakness
- CWE-288
CVE-2026-111560 ↗CVSS 8.6 high AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
OS Command Injection in Barracuda Appliances
- Exploited
- Not in CISA’s exploited catalog
- EPSS
- 1.1% chance of exploitation in the next 30 days · higher than 65% of all CVEs
- Weakness
- CWE-78
Timeline
SecurityWeek
Barracuda ESG Authentication Bypass Flaw Opens Path to Root
watchTowr Labs
Barracuda Networks is your new best friend (Barracuda Email Security Gateway Pre-Auth Remote Root RCE CVE-2026-116606 / CVE-2026-111560)
The Hacker News
Experts Demonstrate Barracuda Email Security Gateway Chain Enabling Root Access Without Login
Barracuda warns that attackers have begun exploiting two patched ESG vulnerabilities
BleepingComputer
Hackers now exploit critical Barracuda ESG flaws to gain root access
www.theregister.com - Articles
Barracuda’s email security gateways bitten by make-me-root vulns
Full coverage · 5 sources
First seen · 5 sources · Full story page · How tiers are decided