🛡️Barracuda Email Gateways Hit by Root-Level Exploit, 470+ Fixes Shipped

Check your Barracuda appliances today, not Monday

Barracuda's Email Security Gateway appliances are being actively exploited, and the attack chain gives intruders root. If you run one of these boxes, this is a patch-today situation. The bugs are a pre-authentication authorization bypass and a command-injection flaw. Chained together, they let an attacker run commands with root privileges. The bypass requires access to the administrative user interface, which narrows the exposure, but that's a smaller barrier than most teams would like. Once in, an attacker can steal data, install backdoors, and take full control of the device. The bypass is rated 9.3 CVSS and the command injection is rated 8.6. The flaws, tracked as CVE-2026-116606 and CVE-2026-111560, touch ESG, load balancer, message archiver, web application firewall, WAF control center, and web security gateway products. Barracuda fixed everything last week in one large patching session that included more than 470 security fixes. The FBI has previously tied PRC-linked attackers to a series of 2023 attacks on Barracuda ESGs, and 27 percent of identified affected organizations were government entities.