Actively Exploited Barracuda Vulnerabilities Allow Authorization Bypass and Root Access

Threat actors are actively exploiting two recently patched Barracuda vulnerabilities (CVE-2026-116606 and CVE-2026-111560) that, when chained, can bypass authorization controls and grant root access to affected devices. CISA has added these flaws to its Known Exploited Vulnerabilities catalog, urging federal agencies to apply patches promptly.