Barracuda confirms exploitation of email gateway flaws that can yield root access

The vulnerabilities have different prerequisites:

• CVE-2026-116606 is an authorization bypass in ESG. Barracuda lists no authentication requirement, provided the attacker can reach the administrative interface, and assigns a CVSS severity score of 9.3.
• CVE-2026-111560 permits command injection. On its own, it requires administrative access and has a vendor-listed CVSS score of 8.6. Barracuda rates both flaws High.

The CERT Santé alert describes the bypass in ESG's configuration-import function: an attacker can invoke it without authenticating, restore a crafted backup archive and change the appliance's global configuration, without user interaction. Barracuda says chaining the bypass with command injection can yield root access—control of the device with its highest privileges.

Barracuda Networks’ company-reported matrix lists affected products and patches; only Email Security Gateway is marked affected by both vulnerabilities. Source: Barracuda Networks.

The patch scope extends beyond email gateways

Barracuda lists six affected product lines, but only ESG is affected by both vulnerabilities. The other five have the command-injection flaw; the advisory does not establish that the same unauthenticated chain applies to them.

The company's patch table provides the following mapping:

Barracuda tells customers to check that they have both the latest firmware and every applicable security patch. Missing patches should be installed manually as soon as possible, and the company recommends enabling automatic patching if it has been disabled. Devices several firmware versions behind may need multiple updates; customers needing help can contact Barracuda Support.

Earlier ESG attacks show the stakes, not the current attackers

Barracuda serves more than 200,000 customers worldwide, spanning smaller businesses, large enterprises and managed service providers, according to a report on the current warning. That is the vendor's overall customer base, not a count of ESG installations or organizations affected by these attacks.

The same report recounts two separate ESG zero-days exploited in 2023 by the hacking group tracked as UNC4841: CVE-2023-7102, which allowed arbitrary code execution, and CVE-2023-2868, used in cyberespionage attacks. Barracuda later disclosed that exploitation of the latter dated back to at least October 2022 and involved malware deployment and data theft.

Those incidents establish a history of attackers compromising these email defenses. They do not identify the perpetrators of the current attacks or demonstrate that data has been stolen in the newly disclosed incidents.

Patch verification comes before a fuller account of the attacks

The current advisory does not name attackers, affected organizations or malware, and gives no exact victim count. Nor does it quantify how many vulnerable management interfaces remain reachable. The public confirmation establishes exploitation, without establishing when attacks started or whether they preceded patch availability.

Customers can act on the information already available: identify affected products, check the applicable patches actually installed, and restrict who can reach their administrative interfaces. A fuller assessment of the campaign requires an attack timeline, details of what intruders did after access, and evidence of how widely the vulnerabilities have been exploited.