Hackers exploit two Barracuda ESG flaws to gain root access

Barracuda Networks says attackers are exploiting two recently patched vulnerabilities in its Email Security Gateway (ESG) appliances. The flaws can let attackers run commands with root privileges.

The vulnerabilities are tracked as CVE-2026-116606 and CVE-2026-111560. Barracuda released security updates for both one week before warning that they were being exploited against a limited number of customers.

The first flaw involves an authentication weakness that can allow an attacker to change an appliance’s global configuration. The second allows unauthenticated attackers to inject operating system commands that run with root privileges. Barracuda says successful exploitation requires access to the targeted device’s administrative user interface, or Admin UI. If combined, the flaws could let an attacker bypass authorization controls and gain root access.

Barracuda says it began remediation and released patches for affected products. It advises customers to restrict Admin UI access to trusted internal networks and use network access controls. Customers whose devices have not received a patch automatically should apply the appropriate update manually. The company also recommends enabling automatic patching if it has been turned off.

The report recalls earlier attacks on Barracuda ESG appliances. In 2023, the UNC4841 group exploited two zero-day flaws, CVE-2023-7102 and CVE-2023-2868. Barracuda later said CVE-2023-2868 had been exploited for at least seven months, since at least October 2022.