CISA added the command-injection and authentication-bypass flaws to its catalog after Barracuda said exploitation had affected a small number of organizations. Administrators can apply the company’s patches and restrict access to affected devices.
On 10 November 2026, US cybersecurity agency CISA added two Barracuda vulnerabilities to its Known Exploited Vulnerabilities catalog based on evidence of active exploitation. CVE-2026-111560 allows operating-system command injection, while CVE-2026-116606 bypasses authentication in Barracuda Email Security Gateway.
Barracuda disclosed the flaws and released fixes on 2 November 2026; it did not report active exploitation at the time. In a November 9 update, the company said it had since identified exploitation affecting a small number of organizations.
The command-injection flaw requires authenticated administrative access. Mandiant says it lets an administrator insert operating-system commands that run with root privileges, the highest level of access to the device. The authentication bypass needs no login, but Barracuda says an attacker must be able to reach the gateway’s administrative interface. Mandiant says the bypass can allow unauthorized changes to the device’s overall configuration.
Barracuda says an attacker could combine the flaws to bypass access controls and obtain root access. On 5 November 2026, the company corrected its earlier advisory to say the bypass did not require administrative authentication, although access to the administrative interface was still necessary.
The attackers' identities and whether they obtained root access remain unknown, The Register said. Barracuda did not give the outlet an exact number of affected organizations and said it worked directly with affected businesses.
Mandiant lists the following Barracuda products and versions as affected by the command-injection flaw. Barracuda rates both vulnerabilities as high severity, with CVSS scores of 8.6 for CVE-2026-111560 and 9.3 for CVE-2026-116606.
CISA announced on 10 November that it had added vulnerabilities in Cisco BroadWorks and Openwave Webtop Media Transcoder to its catalog, citing evidence that attackers are exploiting both.
| Product | Affected versions |
|---|---|
| Email Security Gateway | 9.4.0.27 and earlier |
| Load Balancer Application Delivery Controller | 6.4.0 and earlier |
| Web Application Firewall | 11.0.1 and earlier |
| Web Security Gateway | 16.1.100.100 and earlier |
| Message Archiver | 5.5.4.0 and earlier |
| WAF Control Center | 2.2.1 and earlier |
For the authentication bypass, Mandiant lists Email Security Gateway versions earlier than 9.4.0.030 as affected.
Barracuda advises customers to check that affected systems have the latest firmware—the software that runs the devices—and all security patches. If an automatic patch has not been applied, customers should apply it manually as soon as possible; the company also recommends enabling automatic patching where it has been turned off. Devices several firmware versions behind may need more than one update.
The company recommends restricting administrative interfaces to trusted internal networks and using network access controls. It says organizations whose administrative interfaces are not publicly accessible from the internet are less exposed to this attack path. Barracuda provides update instructions through Barracuda Campus and support for customers who need help checking firmware or applying patches.
CISA says a federal directive requires civilian executive branch agencies to prioritize rapid fixes for high-risk catalog vulnerabilities on publicly exposed assets that can give attackers total control. It also sets expectations for checks on whether systems were compromised before patching. The directive applies only to those agencies, but CISA encourages all organizations to prioritize fixes for catalog vulnerabilities based on risk.
2 min
The agency describes the Microsoft Outlook vulnerability as a missing user interaction for a potentially unsafe action. Microsoft patched the flaw after attackers exploited it to steal account authentication data.
1 min
The Japanese retailer says it blocked unauthorized access on 6 November and will contact affected customers by email or post.
2 min
