Hackers now exploit critical Barracuda ESG flaws to gain root access

Cybersecurity company Barracuda Networks warned that attackers have begun exploiting two recently patched Email Security Gateway (ESG) vulnerabilities that let them run commands with root privileges. Barracuda released security updates to address the two flaws (tracked as CVE-2026-116606 and CVE-2026-111560) one week ago. The first stems from an Email Security Gateway (ESG) authentication weakness that can be exploited to modify an appliance's global configuration, while the second lets unauthenticated attackers inject OS commands that execute with root privileges. Barracuda also said that successful attacks require access to the administrative user interface (Admin UI) of targeted devices and advised customers to restrict access to trusted internal networks and use appropriate network access controls to limit exposure. "Successful exploitation requires an attacker to have access to the administrative interface of an affected product. If exploited in combination, these vulnerabilities could allow an attacker to bypass authorization controls and obtain root access to the device," the company explained. On Monday evening, Barracuda updated the initial advisory to warn admins that the two flaws are being exploited in attacks targeting a limited number of customers. "Barracuda immediately initiated a comprehensive remediation process and released security patches for affected products. We have identified exploitation activity affecting a small number of organizations," it warned...