Barracuda's ESG flaws are bound by active exploitation.
Barracuda says attackers are exploiting two patched vulnerabilities in its email security gateway: CVE-2026-116606, a 9.3 pre-authentication bypass, and CVE-2026-111560, an 8.6 command injection bug affecting multiple products. In a security advisory, the company said a small number of organizations were affected and confirmed patch support.
The chain is important because it can make web-exposed admin access to execute root-level commands on an edge email device. For the defenders, the immediate priorities are the patch status and whether the ESG management interfaces remain accessible from the public Internet.
Open sources - closed narratives.