Act today Critical Known exploited Patch available CVSS up to 9.3
Barracuda email gateways under attack through chained flaws
The Register - securityBarracudaCVE-2026-116606, CVE-2026-111560
What happened. Barracuda says attackers are exploiting two flaws in its Email Security Gateway (ESG). Chained, they allow commands to run with root privileges. The vendor reports a small number of affected organisations and has released patches. CVE-2026-116606 is rated 9.3.
Who is affected. Organisations running the Barracuda Email Security Gateway. The source does not say which organisations or sectors are affected, nor which versions.
What to do. Apply the Barracuda patches for the Email Security Gateway. Check whether you run these gateways and whether the administrative interface is reachable.
When to act. Act today: Perimeter and plant-adjacent IT: exploitation confirmed; patch Barracuda ESG gateways today.
Editor's reading
Fordetection engineerIT security
- Purdue level
- L5
- L4
Why: An email security gateway sits at the enterprise edge between the internet and business email, so it belongs at the enterprise and internet-edge levels.
- Are you exposed?
Search the inventory for Barracuda Email Security Gateway appliances and check whether their administrative interface is reachable from untrusted networks.
- If you cannot fix it yet
- Restrict access to the gateway administrative interface to a small set of trusted management hosts.
- Do not expose the administrative interface to the internet.
- Keep the gateway out of the plant network until patched.
- Watch for
- Access to the gateway administrative interface from unexpected addresses.
- Unexpected commands or new processes running as root on the gateway.
Inferred from the facts above, not stated by the source. Check it against your own site before acting.
Source: The Register - security (opens theregister.com)
More on CVE-2026-111560 CVE-2026-116606