Attackers are exploiting two Barracuda ESG flaws that can combine to give them root access to vulnerable appliances. Barracuda confirmed attacks affecting a small number of organizations in a November 9 advisory update, one week after releasing security patches.
The vulnerabilities affect authentication and operating system command handling. However, attackers must first reach a device’s administrative interface to exploit them, making access restrictions an important part of the response.
Vulnerabilities allow configuration changes and commands
The first vulnerability, CVE-2026-116606, involves an authentication weakness in Email Security Gateway appliances. Attackers can exploit it to modify a device’s global configuration.
Meanwhile, CVE-2026-111560 allows unauthenticated attackers to inject operating system commands that run with root privileges. Combining the flaws could let an attacker bypass authorization controls and gain extensive control over an affected device.
Barracuda has confirmed exploitation involving a limited number of customers but has not identified the attackers. It also has not publicly detailed the impact on those organizations in the supplied advisory.
Barracuda ESG flaws prompt urgent patch checks
Barracuda urged administrators to check whether their devices had received the appropriate security updates automatically. If an update has not arrived, customers should manually apply the relevant patch as soon as possible.
Furthermore, the company recommends enabling automatic patching on devices where administrators previously disabled it. This helps ensure that future security fixes reach affected systems promptly.
Both vulnerabilities affect Email Security Gateway appliances. However, the command-injection flaw also affects several other Barracuda products, each with a designated patch.
| Affected product | Applicable vulnerabilities | Security patch |
|---|---|---|
| Email Security Gateway | Both flaws | BNSF-40425 for 9.4.017 and later; BNSF-40430 for earlier versions |
| Load Balancer ADC | CVE-2026-111560 | BNADC-16586 |
| Message Archiver | CVE-2026-111560 | BNMA-32468 |
| WAF Control Center | CVE-2026-111560 | BNWF-60060 |
| Web Application Firewall | CVE-2026-111560 | BNADC-16586 |
| Web Security Gateway | CVE-2026-111560 | BNYF-24789 |
Alongside patching, Barracuda advises customers to restrict administrative access to trusted internal networks. Appropriate network access controls can reduce exposure because exploitation depends on reaching the Admin UI.
Earlier attacks targeted government email systems
The current warning follows previous campaigns against Barracuda email appliances. In 2023, the UNC4841 hacking group exploited CVE-2023-7102 to execute arbitrary code and separately abused CVE-2023-2868 in cyberespionage attacks.
Investigators later established that attackers had exploited CVE-2023-2868 since at least October 2022, months before its disclosure. They deployed malware, including SeaSpy and Saltwater, and stole information from compromised devices.
Almost one-third of the systems compromised in that earlier campaign belonged to government agencies. Nevertheless, the supplied advisory does not connect those historical attacks to the current exploitation of the Barracuda ESG flaws.
0 responses to “Barracuda ESG flaws let attackers gain root access”