Summary
Barracuda Networks has warned that attackers have begun exploiting two recently patched vulnerabilities in its Email Security Gateway (ESG) appliances that let them run commands with root privileges. Barracuda's updated advisory says exploitation has hit "a small number of organizations." Patches were released about a week before the report.
The Vulnerabilities
| CVE | Description | Affected products |
|---|---|---|
| CVE-2026-116606 | Authentication weakness allowing modification of the appliance's global configuration | ESG only |
| CVE-2026-111560 | Unauthenticated OS command injection running as root | ESG, Load Balancer ADC, Message Archiver (BMA), WAF Control Center (WCC), Web Application Firewall (WAF), Web Security Gateway (WSG) |
Chained, the flaws can bypass authorization and yield root access. The source article does not state CVSS scores. Barracuda says exploitation requires access to the affected product's administrative interface.
Patches
| Product | Patch |
|---|---|
| ESG (9.4.017 and later) | BNSF-40425 |
| ESG (earlier than 9.4.017) | BNSF-40430 |
| Load Balancer ADC | BNADC-16586 |
| Message Archiver | BNMA-32468 |
| WAF Control Center | BNWF-60060 |
| WAF | BNADC-16586 |
| Web Security Gateway | BNYF-24789 |
Recommended Actions
- Apply the patch immediately. If it was not applied automatically, install it manually. Barracuda recommends enabling automatic patching.
- Restrict the Admin UI to trusted internal networks and use network access controls to limit exposure.
- Check appliances for unexpected configuration changes and unfamiliar processes or outbound connections.
Background
ESG appliances are a repeat target. Barracuda previously patched CVE-2023-7102, an ESG flaw exploited by the UNC4841 group, and CVE-2023-2868, a 2023 zero-day later found to have been exploited since at least October 2022. Mandiant reported that almost a third of systems breached in the 2023 campaign belonged to government agencies.