Hackers now exploit critical Barracuda ESG flaws to gain root access

The article has to stay inside the source's facts and hit the section length rules, so I'm counting words and sentences before the final text.Cybersecurity company Barracuda Networks warned that attackers have begun exploiting two recently patched Email Security Gateway (ESG) vulnerabilities that let them run commands with root privileges. BleepingComputer's report by Sergiu Gatlan, published November 10, 2026 at 05:10 AM, says Barracuda released security updates for CVE-2026-116606 and CVE-2026-111560 one week earlier. CVE-2026-116606 is an ESG authentication weakness that can modify an appliance's global configuration, and CVE-2026-111560 lets unauthenticated attackers inject OS commands that execute with root privileges.

This piece follows those two flaws from the Admin UI limit Barracuda placed on exploitation, through the Monday evening warning that attacks are targeting a limited number of customers, to the patch named for each affected product in the advisory table. It is for administrators who run Email Security Gateway and the other affected appliances at small- to medium-sized businesses (SMBs), large enterprises, and managed service providers (MSPs). The company was founded in 2003 and now has more than 200,000 customers worldwide.

01Two patched ESG flaws, root commands

CVE-2026-116606 stems from an Email Security Gateway authentication weakness. Barracuda said that weakness can be exploited to modify an appliance's global configuration. The advisory table marks only Email Security Gateway as affected by CVE-2026-116606, and marks every other listed product No.

CVE-2026-111560 lets unauthenticated attackers inject OS commands. Barracuda said those commands execute with root privileges. The advisory table marks this CVE Yes for Email Security Gateway, Load Balancer ADC, Message Archiver, WAF Control Center, Web Application Firewall, and Web Security Gateway.

Barracuda released the security updates for CVE-2026-116606 and CVE-2026-111560 one week before the November 10, 2026 report. The report, published at 05:10 AM, says attackers have begun exploiting those patched flaws. Barracuda added the exploitation warning to its advisory on Monday evening.

02Admin UI and authorization bypass

Barracuda said successful attacks require access to the administrative user interface, the Admin UI, of targeted devices. Customers were advised to restrict that access to trusted internal networks. The company also told them to use appropriate network access controls to limit exposure on those devices.

"Successful exploitation requires an attacker to have access to the administrative interface of an affected product," Barracuda explained. "If exploited in combination, these vulnerabilities could allow an attacker to bypass authorization controls and obtain root access to the device," the company added. Barracuda assigned that root access to the combined use of CVE-2026-116606 and CVE-2026-111560.

CVE-2026-111560 is still described as command injection that unauthenticated attackers can perform. The advisory nevertheless says a successful attack on an affected product needs the administrative interface. Both statements are Barracuda's: the injection itself does not require authentication, and exploitation of the affected devices still depends on reaching the Admin UI.

03Monday evening exploitation warning

Barracuda updated the initial advisory on Monday evening, warning administrators that the two flaws are being exploited in attacks targeting a limited number of customers. "Barracuda immediately initiated a comprehensive remediation process and released security patches for affected products," the company wrote. "We have identified exploitation activity affecting a small number of organizations."

"If a patch has not been automatically applied, customers should manually apply the appropriate patch as soon as possible," Barracuda said. "If customers have turned off automatic patching, Barracuda recommends setting devices to automatically receive patches." The appropriate patch is the identifier the advisory lists for each affected product.

04Six products and patch builds

The advisory table is the list of affected devices and the security patches Barracuda has for them. Email Security Gateway is the only product marked Yes for both CVE-2026-116606 and CVE-2026-111560. ESG builds at 9.4.017 and later take BNSF-40425 (9.4.017+), and builds below 9.4.017 take BNSF-40430 (<9.4.017).

Load Balancer ADC is marked No for CVE-2026-116606 and Yes for CVE-2026-111560, and its patch is BNADC-16586. Message Archiver (BMA) follows that same split and is patched by BNMA-32468. WAF Control Center (WCC) is also exposed only to CVE-2026-111560, and Barracuda lists patch BNWF-60060 for it.

Web Application Firewall (WAF) is marked No for CVE-2026-116606 and Yes for CVE-2026-111560. The table assigns WAF patch BNADC-16586, the same identifier it assigns to Load Balancer ADC. Web Security Gateway (WSG) is exposed only to CVE-2026-111560, and its patch is BNYF-24789.

05UNC4841 and the 2023 zero-days

Three years ago, Barracuda patched another Email Security Gateway flaw, CVE-2023-7102, which the UNC4841 hacking group exploited in zero-day attacks to execute arbitrary code. The same year, UNC4841 abused another zero-day, CVE-2023-2868, to target Barracuda ESG appliances as part of a series of cyber-espionage attacks.

Barracuda later revealed that the flaw had been exploited as a zero-day for at least seven months, since at least October 2022. The attackers used it to drop previously unknown SeaSpy and Saltwater malware. They also used it to steal data from compromised devices.

According to cybersecurity firm Mandiant, almost a third of the systems breached in the 2023 campaign belonged to government agencies. Most of them were hacked between October and December 2022. Those months fall in the zero-day period Barracuda said began at least as early as October 2022.