Vulnerabilities
Barracuda warns attackers are exploiting critical ESG flaws for root access
Barracuda Networks says hackers are actively exploiting two critical flaws in its Email Security Gateway, allowing them to gain root access. Patches are available, but some devices remain at risk.
Ross Grant2 min read
The short version
Hackers are taking advantage of two serious security problems in Barracuda's Email Security Gateway, a device used to filter and protect email. If attackers can reach the device's admin panel, they can take full control. Barracuda has released patches, but not all devices are updated yet. Only a few organisations have been targeted so far, but anyone using an unpatched device is at risk.
By the numbers
- 200,000+Barracuda customers worldwideBleepingComputer
- 1 weekTime since patches were released before exploitation reportedBleepingComputer
What happened?
Barracuda Networks has warned that hackers are exploiting two critical vulnerabilities in its Email Security Gateway (ESG) appliances. The flaws allow attackers to gain root access if they can reach the device's administrative interface. Patches are available, but some devices remain unprotected. Only a small number of organisations have been targeted so far, according to Barracuda.
Who is affected
Barracuda Networks' Email Security Gateway (ESG) appliances are at risk. The company serves more than 200,000 customers worldwide, including small and medium businesses, large enterprises, and managed service providers. Barracuda says only a small number of organisations have been targeted so far, but the flaws affect all unpatched ESG devices.
How the flaw works
There are two vulnerabilities, tracked as CVE-2026-116606 and CVE-2026-111560. The first is an authentication weakness in the ESG that lets attackers change the device's global configuration. The second allows unauthenticated attackers to inject operating system commands that run with root privileges (the highest level of access on a device). To exploit these flaws, attackers need access to the device's administrative interface. If both flaws are used together, an attacker can bypass authorisation and take full control of the device.
The response
Barracuda released security patches for both flaws a week before warning of active exploitation. The company says it has started a comprehensive remediation process and urges customers to ensure patches are applied. Devices with automatic updates should already be protected, but those with manual patching need immediate attention. Barracuda recommends restricting access to the administrative interface to trusted internal networks and using network controls to limit exposure.
Has this happened before?
This is not the first time Barracuda ESG appliances have been targeted. In 2023, the UNC4841 hacking group exploited two separate zero-day vulnerabilities in the product to run arbitrary code and steal data. One of those flaws was abused for at least seven months before discovery, affecting nearly a third of breached systems that belonged to government agencies, according to Mandiant. Attackers used those flaws to install malware and exfiltrate data from compromised devices.
What you should do
If you use Barracuda ESG, check that your device is running the latest patched version. If automatic patching is disabled, enable it or apply the updates manually. Restrict access to the admin interface to trusted users and networks only. Review your network access controls to reduce the risk of exploitation. If you suspect compromise, follow incident response procedures and contact Barracuda support for guidance.
Why it matters
These flaws can give attackers complete control over email security devices, which often handle sensitive information. If left unpatched, they could be used to steal data or launch further attacks inside an organisation. Past incidents show that attackers have targeted these devices for espionage and data theft.
Key points
- Barracuda ESG flaws are being actively exploited for root access.
- Attackers need admin interface access to exploit the vulnerabilities.
- Patches are available, but manual action may be needed for some devices.
- Barracuda recommends restricting admin access and applying updates immediately.
- Similar flaws in Barracuda ESG have been exploited in the past for espionage.
Sources
BleepingComputer
Reference
