Barracuda ESG Root-Access Flaws Under Active Exploitation: What Defenders Must Do Now

As reported by BleepingComputer, Barracuda Networks has confirmed active in-the-wild exploitation of two recently patched Email Security Gateway (ESG) vulnerabilities — CVE-2026-116606 and CVE-2026-111560 — that, when chained, allow attackers to bypass authorization controls and execute OS commands with root privileges on affected appliances.

This development warrants immediate attention from any organization running Barracuda ESG or related product lines. The attack vector requires access to the administrative interface, but the second flaw in the chain is an unauthenticated OS command injection — meaning once an attacker reaches the Admin UI, they don't need valid credentials to pivot to root. That's a critical distinction that elevates this far beyond a routine patching exercise.

Vulnerability Breakdown

CVE-2026-116606

Authentication weakness in ESG Admin UI enabling unauthorized modification of global appliance configuration.

CVE-2026-111560

Unauthenticated OS command injection allowing arbitrary command execution with root privileges. Affects ESG and multiple additional Barracuda product lines.

Barracuda describes both as critical. Patches were released approximately one week prior to the exploitation confirmation, meaning the window between disclosure and active targeting was narrow — a pattern consistent with threat actors rapidly reverse-engineering published advisories.

Affected Products and Patch Reference

Who Is Most at Risk

Organizations most exposed are those that have disabled automatic patching on Barracuda appliances or have Admin UI interfaces exposed to broader network segments — including perimeter-facing or VPN-accessible zones. Barracuda's own guidance confirms that successful exploitation requires access to the administrative interface, which means network-level segmentation is your most effective compensating control if you cannot patch immediately.

Industries heavily reliant on email security gateways as perimeter defenses — finance, healthcare, government contractors, and managed service providers running multi-tenant Barracuda deployments — face elevated risk given the potential for data exfiltration and lateral movement from a compromised appliance.

Historical Context: Barracuda as a Repeat Target

This is not Barracuda's first encounter with serious exploitation. In 2023, the UNC4841 threat group leveraged CVE-2023-2868 — a zero-day exploited for at least seven months — to deploy SeaSpy and Saltwater malware and exfiltrate data from ESG appliances. CVE-2023-7102 followed shortly after. The fact that Barracuda appliances are now being targeted again, with a similar pattern of chaining authentication bypass to command injection, suggests these devices remain high-value targets for both criminal and state-aligned actors.

The recurring pattern is clear: perimeter security appliances that inspect all inbound email are inherently high-value targets. A compromise here doesn't just affect one system — it potentially exposes every downstream recipient.

Shield53 Recommendations

Immediate Actions

Longer-Term Hardening

• Implement a regular patch verification cadence — don't assume automatic patching is functioning without periodic confirmation.
• Adopt a zero-trust approach to appliance management interfaces: dedicated management VLANs, bastion hosts, and MFA where supported.
• For organizations with multi-appliance Barracuda deployments, consider whether the blast radius of a single compromised appliance can be contained through improved network isolation.
• Subscribe to vendor security advisories and ensure they route to operational teams responsible for patching — not just to a security mailbox that may go unread for days.

The gap between patch release and active exploitation in this case was approximately one week. For organizations that treat email security gateways as set-and-forget appliances, this incident is a reminder that these devices sit on the front line — and adversaries know it.