Hackers now exploit critical Barracuda ESG flaws to gain root access

Cybersecurity company Barracuda Networks warned that attackers have begun exploiting two recently patched Email Security Gateway (ESG) vulnerabilities that let them run commands with root privileges.

Barracuda released security updates to address the two flaws (tracked as CVE-2026-116606 and CVE-2026-111560) one week ago.

The first stems from an Email Security Gateway (ESG) authentication weakness that can be exploited to modify an appliance's global configuration, while the second lets unauthenticated attackers inject OS commands that execute with root privileges.

Barracuda also said that successful attacks require access to the administrative user interface (Admin UI) of targeted devices and advised customers to restrict access to trusted internal networks and use appropriate network access controls to limit exposure.