Attackers exploit Barracuda ESG flaws after PoC release

Barracuda Networks has disclosed that attackers are exploiting a vulnerability chain in Barracuda ESG (Email Security Gateway) against a small number of organisations. The chain combines two flaws: CVE-2026-116606, an authentication bypass in the ESG password-change logic, and CVE-2026-111560, a command-injection flaw in how the appliance handles timezone settings.

Public exploit code and a full technical write-up were released by watchTowr Labs, with a PoC exploit available, increasing the likelihood of exploitation in the wild. Barracuda urges immediate action to update to the latest firmware and to restrict admin interfaces.

The two flaws together allow an unauthenticated attacker with access to the ESG admin interface to upload a crafted backup and execute commands as root, effectively giving root access to the unit. CVE-2026-116606 is described as enabling an authentication bypass that can restore a compatible backup archive, while CVE-2026-111560 enables OS command injection via an uncleaned timezone value passed to a shell command.

Evidence cited by the report notes that exploitation activity has been observed affecting a small number of organisations, with public proof-of-concept code already available. Barracuda’s advisory also points to the need for patching, noting that patches are available in version 9.4.0.030 and that admin interfaces should be secured from internet exposure. The Canadian Centre for Cyber Security has published an advisory, and CISA has not yet added the CVEs to KEV as of 9 November 2026.