Hackers have exploited two vulnerabilities in Barracuda’s Email Security Gateway (ESG) in attacks on a small number of organizations, the company has confirmed.
Barracuda said in an advisory on Nov. 9 that it had identified “exploitation activity affecting a small number of organizations.” The company did not say who was behind the attacks or how many customers were affected.
Barracuda first disclosed the flaws on Nov. 2, when it published the advisory and released patches.
The US Cybersecurity and Infrastructure Security Agency (CISA) added both flaws to its Known Exploited Vulnerabilities catalog on Nov. 10, giving federal agencies until Nov. 13 to patch.
Chained flaws lead to root access
The first flaw, CVE-2026-116606, is an authorization bypass in ESG with a CVSS score of 9.3. It does not require a login, but an attacker must be able to reach the device’s admin interface.
The second, CVE-2026-111560, is a command injection flaw scored 8.6. It also affects Barracuda’s Load Balancer ADC, Message Archiver, WAF Control Center, Web Application Firewall and Web Security Gateway.
“If exploited in combination, these vulnerabilities could allow an attacker to bypass authorization controls and obtain root access to the device,” Barracuda said.
Researchers at watchTowr published a technical analysis of the chain on Nov. 5. They showed how a failed password change request lets an attacker carry on with a low-privileged session, then run commands as root through a crafted backup restore.
What admins should do
Barracuda has released patches for all affected products. They are normally applied automatically, but the company said customers should apply them manually if that hasn’t happened, and switch automatic patching back on if it was turned off.
Devices running firmware that is several versions out of date may need more than one update.
Barracuda also advised organizations to restrict access to administrative interfaces to trusted internal networks. Devices whose admin interface isn’t reachable from the internet are “less exposed to this attack path,” the company said.
It is not the first time ESG has been targeted. In 2023, Barracuda told customers to physically replace their appliances after a China-linked group, tracked by Mandiant as UNC4841, exploited an earlier zero-day in the product, CVE-2023-2868.
Barracuda has not linked the new attacks to that campaign.
