Barracuda warns attackers are exploiting ESG flaws to gain root access

Barracuda Networks said attackers have begun exploiting two vulnerabilities in its Email Security Gateway (ESG) that can be combined to give root access to appliances. BleepingComputer reported that Barracuda shipped fixes for the two issues, tracked as CVE-2026-116606 and CVE-2026-111560, a week before it warned of exploitation.

Barracuda described CVE-2026-116606 as an ESG authentication weakness that allows modification of an appliance's global configuration. CVE-2026-111560 is an OS command injection flaw that unauthenticated attackers can use to run commands with root privileges. The company said successful exploitation requires access to the administrative interface and advised customers to restrict that interface to trusted internal networks. On Monday evening Barracuda updated its advisory to say exploitation activity has affected a small number of organizations. The company told customers to apply patches manually if automatic patching is off. Barracuda said: "We have identified exploitation activity affecting a small number of organizations."

Barracuda's advisory names Load Balancer ADC, Message Archiver, WAF Control Center, Web Application Firewall, Email Security Gateway and Web Security Gateway among the affected products. ESG is affected by both flaws; the other products are affected by CVE-2026-111560 only, and each has a listed patch.

Security researcher Sina Kheirkhah from watchTowr Labs published technical details on 5 November 2026. watchTowr Labs rated CVE-2026-116606 as 9.3 critical for a pre-authentication authorization bypass and CVE-2026-111560 as 8.6 high for an OS command injection. The fixes are in ESG version 9.4.0.029. The researchers compared version 9.4.0.027 with 9.4.0.029 and traced the first weakness to password-change handling in Index.pm. The researchers said an unauthenticated password-change request with mismatched passwords causes the flawed code to assign a login-screen user role rather than halting, so execution continues to further handlers; the patch instead sends an immediate JSON login response.

The second vulnerability involves backup restoration. Backup2.pm and fix_tz.pl use Perl backticks to run sed commands that include a system_timezone value that is not validated. Because the timezone update process runs through sudo, injected shell commands can execute as root. watchTowr Labs reached the vulnerable code through bayesian_upload.pm and a specially crafted backup.xml file. watchTowr Labs also released a Python tool on GitHub that generates a detection artifact to test if an ESG appliance is vulnerable. Administrators should update affected appliances, check for backup restoration activity, look for unexpected configuration changes, limit access to administrative interfaces, and watch for suspicious commands and appliance behavior.

Barracuda has dealt with ESG zero-day exploitation before. In 2023 it patched CVE-2023-7102 after UNC4841 used it in zero-day attacks. UNC4841 also abused CVE-2023-2868 that same year; Barracuda later said attackers had been using that vulnerability prior to any fix for no less than seven months from October 2022, dropping SeaSpy and Saltwater and exfiltrating data. Mandiant said nearly a third of systems breached in that campaign belonged to government agencies.

Update, November 10, 2026

The U.S. Cybersecurity and Infrastructure Security Agency added CVE-2026-111560, the Barracuda OS command injection flaw, to its Known Exploited Vulnerabilities Catalog on Tuesday. CISA describes the catalog as its "authoritative source of vulnerabilities that have been exploited in the wild" and says organizations should use it to prioritize vulnerability management. The entry lists the flaw under CWE-78, OS command injection.

Update, November 10, 2026

The Register reported Tuesday that Barracuda declined to answer its questions, including how many organizations have been affected by the ESG exploitation. A company spokesperson told the publication that Barracuda "worked directly" with affected businesses "to quickly address the issue" and that "Barracuda acted promptly to remediate the vulnerabilities, releasing patches for affected products." The Register added that it is not yet known who is responsible for the attacks or whether intruders gained root access.

Update, November 11, 2026

SecurityWeek reported Wednesday that CISA added CVE-2026-116606 to its Known Exploited Vulnerabilities Catalog on Tuesday, alongside the command injection flaw CVE-2026-111560. Under Binding Operational Directive 26-04, federal agencies have three days to patch. Neither Barracuda nor CISA has published details of the exploitation, but SecurityWeek said cybersecurity firm Previdian logged 17 attempts against CVE-2026-116606 over November 9 through 11, coming from 15 IP addresses in three countries.