Barracuda

Exploited Barracuda ESG auth bypass and root command injection flaws land on CISA KEV with Nov 13 deadline

Barracuda updated its advisory on November 9 to confirm that the authorization bypass CVE-2026-116606 and the command injection CVE-2026-111560 in Email Security Gateway have been exploited against a small number of organizations; chained, they give root on the device when the attacker can reach the admin interface .