Barracuda Networks has confirmed that attackers are actively exploiting two vulnerabilities in its Email Security Gateway (ESG) appliance, chaining them together to gain full root-level control of the device without ever logging in. The first flaw, CVE-2026-116606 (CVSS 9.3), is a pre-authentication authorization bypass that lets an attacker reach ESG's admin interface with no credentials at all. The second, CVE-2026-111560 (CVSS 8.6), is a command injection bug — also present in Barracuda's Load Balancer ADC, Message Archiver, WAF Control Center, Web Application Firewall, and Web Security Gateway products — that turns that admin access into arbitrary commands running as root. Barracuda says it has observed exploitation of the chain "affecting a small number of organisations" and has pushed a mandatory firmware update, version 9.4.0.030 or later, which installs automatically on internet-connected appliances with auto-updates enabled.
Barracuda ESG has been targeted before: in 2023, a different zero-day in the same product line was exploited for months by a China-linked group before discovery, and many affected customers ended up replacing their appliances entirely rather than relying on a patch. That history is part of why security researchers are treating this new chain seriously even though Barracuda describes current victim numbers as small — proof-of-concept details are now public, which typically widens the pool of attackers within days.
What this means for your business
An Email Security Gateway sits directly in your mail flow, scanning every message in and out for spam, phishing, and malware — which means root access to one isn't just a mail problem, it's a foothold inside your network with a trusted vantage point over all your email traffic. Many small businesses don't run ESG themselves; it's deployed and managed by an IT provider or MSP on their behalf, often without the business ever seeing the admin console.
This week, ask your IT provider directly: do we run Barracuda ESG, ADC, Message Archiver, WCC, WAF, or WSG, and is it confirmed on firmware 9.4.0.030 or later? If auto-update is disabled — common on appliances businesses prefer to patch on their own schedule — it needs a manual push now rather than at the next maintenance window. Barracuda is also advising that the admin interface on any of these products be restricted to trusted internal networks, not left reachable from the open internet; that's a sound baseline for any security appliance, not just this one. If your provider confirms a device was exposed before the patch landed, ask whether they've reviewed logs for signs of compromise, not just whether the update has been applied.