“We have identified exploitation activity affecting a small number of organizations,” the security vendor said in a late Monday night update to its earlier security advisory. Barracuda declined to answer The Register’s questions, including one about how many organizations have been hit by attackers.
A company spokesperson told us that it “worked directly” with the affected businesses “to quickly address the issue. Barracuda acted promptly to remediate the vulnerabilities, releasing patches for affected products.”
The vendor disclosed and fixed the vulnerabilities, CVE-2026-116606 and CVE-2026-111560, last week. CVE-2026-116606 is a 9.3 CVSS-rated, pre-authentication authorization bypass flaw in ESG.
While authentication is not required to exploit this vulnerability, the attacker must have access to the administrative user interface. As Purplecop Security founder Tausif Ahmed said on Tuesday: “If your Email Security Gateway's admin UI is open to the internet, that's the first thing I'd close today.”
