Barracuda’s email security gateways bitten by make-me-root vulns

Barracuda says attackers are exploiting two vulnerabilities in its Email Security Gateway products. Chained together, the flaws could let an attacker bypass authorisation and run commands with root privileges, potentially giving them full control of a device.

The company has identified activity affecting a small number of organisations but has not disclosed how many or whether attackers obtained root access. The vulnerabilities, disclosed and patched last week, are CVE-2026-116606, rated 9.3, and CVE-2026-111560, rated 8.6; the latter also affects several other Barracuda products. The first flaw requires access to the administrative interface, prompting a security researcher to urge organisations to close internet access to it.