Security · High impactFan score 67 · Tier A4 sources

Hackers now exploit critical Barracuda ESG flaws to gain root access

BleepingComputer · By Sergiu Gatlan · 2h ago

The Brief · written from 4 sources

Two flaws in Barracuda's Email Security Gateway, an authentication bypass and a command injection, can be chained to run commands as root.
The chain needs no login, according to watchTowr Labs, which detailed the attack.
Barracuda released patches for the flaws.

Why it matters

An unauthenticated path to root on an internet-facing email gateway gives an attacker full control of the appliance, including the mail it filters, so affected appliances should be patched promptly.

Who’s affected

Organisations running Barracuda Email Security Gateway appliances

What to do

Apply the patches Barracuda released for the Email Security Gateway appliance

CVE-2026-116606
CVE-2026-111560
#barracuda
#email-security
#authentication-bypass
#command-injection
#root-access
#vulnerability

Cybersecurity company Barracuda Networks warned that attackers have begun exploiting two recently patched Email Security Gateway (ESG) vulnerabilities that let them run commands with root privileges. [...]

Read the full story at bleepingcomputer.com ↗