Barracuda alerts customers to active attacks targeting newly patched gateway flaws

Cybersecurity company Barracuda Networks is warning that attackers are actively exploiting two recently patched security flaws affecting its Email Security Gateway appliances. The company released security updates for the two vulnerabilities, tracked as CVE-2026-116606 and CVE-2026-111560, a week prior to reporting that an active campaign has targeted a small number of customer organizations. [1][2]

The first issue involves an authentication weakness that lets an attacker alter global appliance configurations, while the second allows unauthenticated attackers to execute operating system commands with root privileges. Barracuda explained that successfully chaining the flaws allows attackers to bypass authorization controls entirely, though the assault requires access to the device's administrative user interface. The vendor advised customers to manually apply available patches if automatic updates are turned off and urged administrators to restrict management interfaces to trusted internal networks. [1][2]

Beyond the Email Security Gateway, the command injection flaw affects additional appliances, including the Load Balancer ADC, Message Archiver, WAF Control Center, Web Application Firewall, and Web Security Gateway. The incident follows previous zero-day activity against Barracuda gateway systems, such as a 2023 cyber-espionage campaign attributed to the threat group UNC4841 that breached government and enterprise networks. [2]