Hackers Exploit Barracuda ESG Flaws to Gain Root Access

"Successful exploitation requires an attacker to have access to the administrative interface of an affected product. If exploited in combination, these vulnerabilities could allow an attacker to bypass authorization controls and obtain root access to the device," the company explained.

CVE-2026-116606 and CVE-2026-111560

Two recently patched flaws in Barracuda Networks' Email Security Gateway (ESG) permit attackers to modify appliance configuration and execute operating‑system commands with root privileges. Barracuda tracked the bugs as CVE-2026-116606 and CVE-2026-111560. According to the vendor's advisory, the first vulnerability stems from an ESG authentication weakness that can be used to change an appliance's global configuration. The second allows unauthenticated attackers to inject OS commands that execute with root privileges.

Barracuda's advisory, patches, and guidance

Barracuda released security updates to address both flaws one week prior to its updated advisory. The company said it "immediately initiated a comprehensive remediation process and released security patches for affected products." A table embedded in the advisory lists all affected devices and the available security patches. Barracuda warned administrators that successful attacks require access to the administrative user interface (Admin UI) and advised customers to restrict Admin UI access to trusted internal networks and to use appropriate network access controls to limit exposure.

In practical terms Barracuda urged customers to ensure patches are applied promptly. If a patch has not been automatically applied, customers were told to manually apply the appropriate patch "as soon as possible." The vendor also recommended that customers who had turned off automatic patching set devices to automatically receive patches.

Exploitation targeting a small number of customers

On Monday evening Barracuda updated its initial advisory to warn that the two flaws are being exploited in attacks. The company said it has "identified exploitation activity affecting a small number of organizations," characterizing the current incidents as limited in scope but real and ongoing. The vendor's public guidance reiterated that exploitation requires access to the appliance's administrative interface, and that the two flaws could be combined to bypass authorization controls and obtain root access.

History of ESG zero‑days: UNC4841, SeaSpy, and Saltwater

Barracuda's warning comes against a documented history of ESG appliances being targeted with zero‑days. Three years ago the company patched CVE-2023-7102 after the UNC4841 hacking group exploited it in zero‑day attacks to execute arbitrary code. In the same year UNC4841 also abused CVE-2023-2868 to target Barracuda ESG appliances as part of a series of cyber‑espionage attacks.

Barracuda later disclosed that one flawed component had been exploited as a zero‑day for at least seven months — "since at least October 2022" — during which attackers dropped previously unknown SeaSpy and Saltwater malware and stole data from compromised devices. According to Mandiant, almost a third of systems breached during that 2023 campaign belonged to government agencies, most of them hacked between October and December 2022.

What this means for SMBs, large enterprises, and managed service providers (MSPs)

• SMBs: Many small‑ and medium‑sized businesses may run ESG appliances with broader Admin UI exposure; Barracuda's advisory specifically recommends restricting Admin UI access to trusted internal networks and restoring automatic patching where it has been disabled.
• Large enterprises: Organizations with ESG deployments should verify that the patches listed in Barracuda's embedded table are applied and validate network access controls around administrative interfaces, because the two flaws can be combined to yield root access.
• MSPs: Managed service providers — named by Barracuda among its customer base — should confirm patch status across client devices and consider centralizing or enforcing automatic updates, since Barracuda emphasized manual action if automatic patches have not been applied.

Barracuda was founded in 2003 and the company now counts more than 200,000 customers worldwide, including SMBs, large enterprises, and MSPs — a footprint that helps explain why the vendor moved quickly to patch and to notify customers. For organizations running Barracuda ESG appliances, the immediate steps the vendor prescribed are concrete and narrow: confirm administrative interface access is restricted, verify patches are applied, and enable automatic patching where it was disabled. The advisory leaves open how widely exploitation might spread beyond the "small number of organizations" Barracuda identified; for now the company's patches and guidance are the next line of defense.

Source: BleepingComputer