An update to my post on Barracuda’s ESG root-chain bugs. Barracuda says the two flaws, CVE-2026-116606 and CVE-2026-111560, are now being exploited against a small number of organizations, BleepingComputer reports.
What’s new
Patches went out about a week ago. On Monday evening Barracuda updated the advisory: if automatic patching didn’t catch it, apply the patch by hand, and turn automatic patching back on. Successful attacks need access to the administrative UI, so keep that interface on a trusted network, not the internet.
ESG is fixed with BNSF-40425 (9.4.017+) or BNSF-40430 (older than 9.4.017). The command-injection bug also hits Load Balancer ADC, Message Archiver, WAF Control Center, WAF and Web Security Gateway, each with its own patch in Barracuda’s table.
My take
Barracuda ESG has a painful history with exploited bugs. Patch now, and if that admin UI is reachable from outside, pull it off the internet today.
God Bless, and Use the Source!
