Hackers now exploit critical Barracuda ESG flaws to gain root access

Barracuda Networks confirmed that threat actors are now actively abusing two vulnerabilities in its Email Security Gateway product line that were patched just a week earlier. The flaws, CVE-2026-116606 and CVE-2026-111560, can be chained together to bypass authorization checks and ultimately gain root-level control of an affected device, though the attacker first needs access to the appliance's admin interface. Barracuda says it has already observed real-world exploitation hitting a small set of customers and is urging all admins to verify patches have been applied or to enable automatic updates. The affected lineup extends beyond ESG itself to the Load Balancer ADC, Message Archiver, WAF Control Center, Web Application Firewall, and Web Security Gateway, each with its own fix build listed in Barracuda's advisory. This follows a pattern for Barracuda appliances, which were previously targeted by the Chinese UNC4841 group through separate zero-days (CVE-2023-7102 and CVE-2023-2868) that led to widespread breaches, including at government agencies.