Barracuda Networks has warned that attackers are now exploiting two recently patched flaws in its Email Security Gateway (ESG) to run commands with root privileges. The company updated its security advisory on Monday evening, 9 November, to say the flaws are being used in attacks against a small number of organisations. The warning turns a patching job that was already urgent into an active incident for any ESG appliance still running old firmware.

Barracuda released fixes for the two flaws, tracked as CVE-2026-116606 and CVE-2026-111560, about a week ago. Together, the pair gives an unauthenticated attacker a path to full control of the gateway, a device that sits at the edge of a company network and inspects every incoming email. Security researchers had already published technical details and proof-of-concept exploit code earlier in November, so the window between disclosure and exploitation was short.

What the two Barracuda flaws do

CVE-2026-116606, rated 9.3 out of 10, is an authorisation bypass in the gateway's password-change logic. When a password change fails, the older code reported the error but did not stop processing the request. That lets an unauthenticated attacker restore a crafted configuration backup archive and change global appliance settings. The flaw affects Email Security Gateway versions earlier than 9.4.0.030.

CVE-2026-111560, rated 8.6, is an operating-system command injection flaw in the way the appliance handles its timezone setting. The value was passed into a shell command without being cleaned up, and because a helper script runs with elevated privileges, injected commands execute as root. The command injection affects the ESG and five other Barracuda products, including the Load Balancer ADC, Message Archiver and Web Application Firewall, although on those products an attacker still needs an administrator account. Only the ESG is exposed to the full chain, because only there can the authorisation bypass supply the access the injection needs.

How the attack works

Chained together, the flaws work like this: one crafted request uploads a malicious backup file and sets a poisoned timezone value inside it. The backup checksum that should block a forged file relies on a fixed secret built into the application code, which researchers found and used to forge valid files. The result is unauthenticated remote code execution as root on any ESG whose administration interface can be reached over the network.

The research team at watchTowr Labs published a detailed analysis of both bugs and released exploit code on GitHub, describing it as a detection artifact generator that accepts any command an operator supplies. That publication lowered the bar for attackers considerably, and Barracuda's confirmation of exploitation followed within days.

The gateway has a painful history. In 2023, a China-linked group exploited an earlier ESG zero-day, CVE-2023-2868, for months before it was found, and some customers had to physically replace their devices. Barracuda has not said who is behind the current attacks or how many customers are affected, and the flaws have not yet been added to the US CISA Known Exploited Vulnerabilities catalogue.

What ESG owners should do now

Barracuda urges customers to make sure their systems are running the latest firmware, with all security patches applied. The fixes are patches BNSF-40425 for firmware 9.4.017 and later, and BNSF-40430 for older firmware, with 9.4.0.030 the fixed version. Patches should apply automatically, but administrators who switched off automatic patching must install them by hand, and devices several versions behind may need more than one update.

Administrators should also restrict the gateway's admin interface so it is not publicly accessible from the internet. Barracuda says organisations whose admin interfaces are not exposed online are less exposed to this attack path. Any ESG with an internet-facing admin interface should be checked for signs of compromise, because with working exploit code now public, further attacks are likely. The Canadian Centre for Cyber Security has also issued an advisory on the flaws. BleepingComputer reports that Barracuda confirmed exploitation on Monday evening, while SecurityOnline.info reports the full technical background to the chained flaws.