Cybersecurity company Barracuda Networks warned that attackers have begun exploiting two recently patched Email Security Gateway (ESG) vulnerabilities that let them run commands with root privileges.
Barracuda released security updates to address the two flaws (tracked as CVE-2026-116606 and CVE-2026-111560) one week ago.
The first stems from an Email Security Gateway (ESG) authentication weakness that can be exploited to modify an appliance's global configuration, while the second lets unauthenticated attackers inject OS commands that execute with root privileges.
Barracuda also said that successful attacks require access to the administrative user interface (Admin UI) of targeted devices and advised customers to restrict access to trusted internal networks and use appropriate network access controls to limit exposure.
"Successful exploitation requires an attacker to have access to the administrative interface of an affected product. If exploited in combination, these vulnerabilities could allow an attacker to bypass authorization controls and obtain root access to the device," the company explained.
On Monday evening, Barracuda updated the initial advisory to warn admins that the two flaws are being exploited in attacks targeting a limited number of customers.
"Barracuda immediately initiated a comprehensive remediation process and released security patches for affected products. We have identified exploitation activity affecting a small number of organizations," it warned.
"If a patch has not been automatically applied, customers should manually apply the appropriate patch as soon as possible. If customers have turned off automatic patching, Barracuda recommends setting devices to automatically receive patches."
The table embedded below lists all affected devices and available security patches.
| Affected Product | CVE-2026-116606 | CVE-2026-111560 | Patch |
|---|---|---|---|
| Email Security Gateway (ESG) | Yes | Yes | BNSF-40425 (9.4.017+), BNSF-40430 (<9.4.017) |
| Load Balancer ADC | No | Yes | BNADC-16586 |
| Message Archiver (BMA) | No | Yes | BNMA-32468 |
| WAF Control Center (WCC) | No | Yes | BNWF-60060 |
| Web Application Firewall (WAF) | No | Yes | BNADC-16586 |
| Web Security Gateway (WSG) | No | Yes | BNYF-24789 |
Three years ago, Barracuda patched another Email Security Gateway flaw (CVE-2023-7102) that the UNC4841 hacking group exploited in zero-day attacks to execute arbitrary code. The same year, UNC4841 abused another zero-day (CVE-2023-2868) to target Barracuda ESG appliances as part of a series of cyber-espionage attacks.
The company later revealed that the flaw had been exploited as a zero-day for at least seven months, since at least October 2022, to drop previously unknown SeaSpy and Saltwater malware and steal data from compromised devices.
According to cybersecurity firm Mandiant, almost a third of systems breached in the 2023 campaign belonged to government agencies, most of them hacked between October and December 2022.
Barracuda was founded in 2003 and now has more than 200,000 customers worldwide, including small- to medium-sized businesses (SMBs), large enterprises, and managed service providers (MSPs).
Adaptive Security's AI agents analyze email intent, context, and behavior to uncover phishing, business email compromise, and invoice fraud.
See what's getting through with a 14-day read-only scan of Microsoft 365 or Google Workspace, with no MX changes.