Skip to content
NewA calmer, faster ZeroHour
Exploit / PoCcriticalExploited in the wild

Attackers exploit Barracuda ESG flaws to gain root access

Original title: Hackers now exploit critical Barracuda ESG flaws to gain root access

BleepingComputerby Sergiu Gatlan ()2 min read
Read at bleepingcomputer.com
Part of a story covered by 10 sourcesBarracuda ESG flaws chained for root; limited exploitation confirmedMerged summary & timeline
AI summary · x-ai/grok-4.7Summaries by Vani AI

Barracuda says a small number of customers were hit after patches for CVE-2026-116606 and CVE-2026-111560 shipped a week earlier.

Barracuda warned that attackers are exploiting two recently patched Email Security Gateway flaws that, combined, bypass authorization and run commands as root. CVE-2026-116606 can change an appliance’s global configuration; CVE-2026-111560 allows unauthenticated OS command injection. Exploitation requires access to the Admin UI and has affected a limited set of customers. Several other Barracuda products are affected only by the command-injection flaw and have separate patches.

Unconfirmed: Barracuda has not named the affected customers or the attackers.

Key facts
  • ESG patches are BNSF-40425 for 9.4.017 and later and BNSF-40430 for earlier releases.
  • Load Balancer ADC, Message Archiver, WAF Control Center, WAF and Web Security Gateway need CVE-2026-111560 fixes.
  • Barracuda advises restricting the Admin UI to trusted networks and enabling automatic patching.
  • The company says exploitation has been seen at a small number of organizations.
Security assessment · AI, from the articleExploited in the wild

Impact: Root command execution when the Admin UI is reachable

ProductAffectedFixed in
Barracuda Email Security Gateway—BNSF-40425 (9.4.017+), BNSF-40430 (<9.4.017)
Barracuda Load Balancer ADC—BNADC-16586
Barracuda Message Archiver—BNMA-32468
Barracuda WAF Control Center—BNWF-60060
Barracuda Web Application Firewall—BNADC-16586
Barracuda Web Security Gateway—BNYF-24789
What to do
  1. 1.Apply the listed patch if it was not installed automatically.
  2. 2.Restrict Admin UI access to trusted internal networks.
  3. 3.Turn automatic patching back on if it was disabled.
Analyze CVE-2026-116606 with Vani AIImpact, affected versions, exploitation, mitigations and detection
CVEs
CVE-2026-116606CVE-2026-111560
ATT&CK
T1190 Exploit Public-Facing ApplicationT1059 Command and Scripting Interpreter
Tags
barracudaemail-security-gatewaycommand-injectionroot-accessadmin-ui
Vendors
Barracuda Networks
Products
Email Security GatewayLoad Balancer ADCMessage ArchiverWAF Control CenterWeb Application FirewallWeb Security Gateway

Vulnerabilities mentioned

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2026-111560
Command Injection in Barracuda Appliance Timezone Field
8.61%KEV
KEV
CVE-2026-116606
Auth bypass in Barracuda Email Security Gateway before 9.4.0.030
9.32%KEVPoC
KEV

From the original article

2 min read at bleepingcomputer.com

Cybersecurity company Barracuda Networks warned that attackers have begun exploiting two recently patched Email Security Gateway (ESG) vulnerabilities that let them run commands with root privileges. [...]

BleepingComputer

By Sergiu Gatlan · bleepingcomputer.com

Read the full article at BleepingComputer

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.