Hackers exploit critical Barracuda ESG bugs for root access

Barracuda has confirmed that attackers are now exploiting two critical vulnerabilities in its Email Security Gateway (ESG) appliances. The flaws, tracked as CVE-2026-116606 and CVE-2026-111560, can be chained to bypass authorization controls and grant attackers full root access to the device. These attacks require access to the administrative interface of the targeted appliances.

This gives attackers complete control over the security gateways that protect a company's email traffic. Customers who have not yet applied the patches released last week are urged to do so immediately, either manually or by enabling automatic updates. Barracuda indicates the exploitation is currently limited but active, underscoring the need for swift action.

What to do: Apply the appropriate security patch for your Barracuda product as listed in the advisory.