Barracuda’s email security gateways bitten by make-me-root vulns

Security company Barracuda warns that attackers are exploiting a pre-authentication authorization bypass bug and a command-injection vulnerability in its popular Email Security Gateway (ESG) products that, when chained, could allow the crims to run commands with root privileges. “We have identified exploitation activity affecting a small number of organizations,” the security vendor said in a late Monday night update to its earlier security advisory. Barracuda declined to answer The Register’s questions, including one about how many organizations have been hit by attackers. A company spokesperson told us that it “worked directly” with the affected businesses “to quickly address the issue. Barracuda acted promptly to remediate the vulnerabilities, releasing patches for affected products.” The vendor disclosed and fixed the vulnerabilities, CVE-2026-116606 and CVE-2026-111560, last week. CVE-2026-116606 is a 9.3 CVSS-rated, pre-authentication authorization bypass flaw in ESG. While authentication is not required to exploit this vulnerability, the attacker must have access to the administrative user interface. As Purplecop Security founder Tausif Ahmed said on Tuesday: “If your Email Security Gateway's admin UI is open to the internet, that's the first thing I'd close today.” CVE-2026-111560 is an 8.6-rated command-injection flaw that affects multiple Barracuda products: its ESG, load balancer (ADC), message archiver (BMA), web application firewall (WAF), WAF control center (WCC...