Barracuda Says Attackers Are Exploiting Two Email Security Gateway Flaws
Summary
Barracuda says attackers are exploiting two patched flaws affecting its products, including the Email Security Gateway. Successful exploitation requires access to the Admin UI; the company reports activity at a small number of organizations.
Key points
- Barracuda reports exploitation of CVE-2026-116606 and CVE-2026-111560 against a small number of organizations.
- CVE-2026-116606 can allow changes to an appliance’s global configuration; CVE-2026-111560 allows unauthenticated OS command injection with root privileges.
- Barracuda says attackers need access to the affected device’s administrative interface; exploiting both flaws together could bypass authorization controls and provide root access.
- The flaws were patched a week before Barracuda updated its advisory to report exploitation.
- Patches are listed for the Email Security Gateway and other products, including Load Balancer ADC, Message Archiver, WAF Control Center, Web Application Firewall, and Web Security Gateway.
- Barracuda advises restricting Admin UI access to trusted internal networks and applying patches promptly, including enabling automatic patching.
Article Details
- Vulnerability Types
- Authentication weakness allowing modification of an appliance's global configuration
- OS command injection allowing root-level command execution
- Severity
- Critical
- Exploitation Status
- active
- Exploit Availability
- unknown
- Patch Status
- available
- Workarounds
- Restrict access to the administrative interface to trusted internal networks and use network access controls.
MITRE ATT&CK
T1059 · Command and Scripting InterpreterThe second vulnerability allows unauthenticated attackers with access to the administrative interface to inject OS commands that execute with root privileges.T1068 · Exploitation for Privilege EscalationBarracuda says exploiting the vulnerabilities in combination could bypass authorization controls and obtain root access to the device.
CVE
CVE-2023-2868Barracuda · Barracuda Email Security GatewayThe same year, UNC4841 abused another zero-day (CVE-2023-2868) to target Barracuda ESG appliances as part of a series of cyber-espionage attacks.CVE-2023-7102Barracuda Networks Inc. · Barracuda ESG ApplianceThree years ago, Barracuda patched another Email Security Gateway flaw (CVE-2023-7102) that the UNC4841 hacking group exploited in zero-day attacks to execute arbitrary code.CVE-2026-111560Barracuda Networks · Barracuda Email Security Gateway (ESG); Barracuda Networks · Barracuda Load Balancer Application Delivery Controller (ADC); +4 moreBarracuda released security updates to address the two flaws (tracked as CVE-2026-116606 and CVE-2026-111560) one week ago.CVE-2026-116606Barracuda Networks · Barracuda Email Security Gateway (ESG)Barracuda released security updates to address the two flaws (tracked as CVE-2026-116606 and CVE-2026-111560) one week ago.
Threat Actors
Malware
Saltwaterzero-day for at least seven months, since at least October 2022, to drop previously unknown SeaSpy and Saltwater malware and steal data from compromised devices.SeaSpyas a zero-day for at least seven months, since at least October 2022, to drop previously unknown SeaSpy and Saltwater malware and steal data from compromised devices.