Attackers exploit two Barracuda ESG flaws to gain root access
Barracuda Networks said Monday evening that attackers are exploiting two recently patched vulnerabilities in its Email Security Gateway appliances against a limited number of customers. The company released updates for CVE-2026-116606 and CVE-2026-111560 one week earlier. Barracuda said successful exploitation can allow attackers to run commands with root privileges, giving them the highest level of control over an affected device.
Barracuda said an attacker must first reach the appliance's administrative user interface, known as the Admin UI. The company advised customers to limit that interface to trusted internal networks and use network access controls to reduce exposure.
CVE-2026-116606 is an authentication weakness that can allow an attacker to modify an appliance's global configuration, according to Barracuda. CVE-2026-111560 allows an unauthenticated attacker to inject operating-system commands. Barracuda said the flaws can be used together to bypass authorization controls and obtain root access to the device.
Barracuda said it began a remediation process after identifying exploitation activity affecting a small number of organizations. Customers whose devices have not received an update automatically should apply the appropriate patch manually as soon as possible, the company wrote in its advisory. Barracuda also recommended enabling automatic patching for devices where it has been turned off.
The campaign follows earlier attacks on Barracuda ESG appliances. Three years ago, Barracuda patched CVE-2023-7102 after the UNC4841 hacking group exploited it in zero-day attacks to execute arbitrary code, according to reporting by BleepingComputer. UNC4841 also used CVE-2023-2868 in a series of cyber-espionage attacks that targeted the same appliances.
Barracuda later said CVE-2023-2868 had been exploited as a zero-day for at least seven months, beginning in October 2022. The attacks delivered the previously unknown SeaSpy and Saltwater malware and stole data from compromised devices, according to the company. Mandiant said almost a third of the systems breached in that 2023 campaign belonged to government agencies, most of which were compromised between October and December 2022.