Attackers Exploit Critical Barracuda ESG Vulnerabilities for Root Access

Barracuda Networks has warned that threat actors are actively exploiting two recently patched vulnerabilities in its Email Security Gateway appliances. The flaws, tracked as CVE-2026-116606 and CVE-2026-111560, allow attackers to modify global configurations and execute operating system commands with root privileges. Exploitation requires access to the administrative user interface, prompting Barracuda to advise restricting Admin UI exposure to trusted internal networks. The company confirmed limited attacks against a small number of customers and urged immediate application of patches such as BNSF-40425. Historical context shows UNC4841 previously targeted similar Barracuda ESG zero-days, including CVE-2023-7102 and CVE-2023-2868, to deploy SeaSpy and Saltwater malware. Mandiant reported that nearly one-third of victims in the 2023 campaign were government agencies. Barracuda recommends enabling automatic patching to mitigate further risk across affected products including Load Balancer ADC and Web Application Firewall.

BleepingComputerNovember 10, 2026Translated from English

Read at source

Barracuda Networks has issued an urgent advisory stating that attackers have begun exploiting two critical vulnerabilities in its Email Security Gateway (ESG) appliances to obtain root access.

The flaws, identified as CVE-2026-116606 and CVE-2026-111560, were patched one week earlier. CVE-2026-116606 stems from an authentication weakness that permits modification of an appliance’s global configuration, while CVE-2026-111560 enables unauthenticated attackers to inject and execute OS commands with root privileges.

Successful exploitation requires access to the administrative user interface. Barracuda therefore recommends restricting Admin UI access to trusted internal networks and implementing appropriate network access controls.

On Monday evening the company updated its advisory to confirm active exploitation against a limited number of customers. It immediately initiated remediation and released security patches for all affected products.

Affected Products and Patches

Email Security Gateway (ESG): CVE-2026-116606 and CVE-2026-111560 – patches BNSF-40425 (9.4.017+) and BNSF-40430 (<9.4.017)
Load Balancer ADC: CVE-2026-111560 – patch BNADC-16586
Message Archiver (BMA): CVE-2026-111560 – patch BNMA-32468
WAF Control Center (WCC): CVE-2026-111560 – patch BNWF-60060
Web Application Firewall (WAF): CVE-2026-111560 – patch BNADC-16586
Web Security Gateway (WSG): CVE-2026-111560 – patch BNYF-24789

Three years earlier, the UNC4841 hacking group exploited CVE-2023-7102 and CVE-2023-2868 as zero-days against ESG appliances, deploying previously unknown SeaSpy and Saltwater malware. Mandiant later revealed that almost one-third of compromised systems belonged to government agencies.

Barracuda Networks CVE-2026-116606 CVE-2026-111560 UNC4841 CVE-2023-2868 SeaSpy Saltwater

ShareX Facebook LinkedIn Reddit

Meridian digestThe week's most consequential security stories, distilled into one briefing.See the digest

More in Vulns & Exploits

Vulns & Exploits

Apple Patches iMessage Group Chat Privacy Flaws and Bluetooth Pairing Vulnerabilities

Apple has released multiple security updates addressing critical flaws in iMessage that could allow unauthorized access to group chat messages. One vulnerability, tracked as CVE-2026-113961, is an authorization issue that permitted remote attackers to join group chats and receive ongoing messages through improved validation fixes. A second issue, CVE-2026-113960, enabled newly added participants to access messages sent before they joined the conversation. The updates also resolve an out-of-bounds write flaw in Google's Brotli compression library, CVE-2026-111497, which CISA added to its Known Exploited Vulnerabilities catalog on October 27. Additionally, nine separate updates address multiple Bluetooth and AirPlay vulnerabilities that could enable unauthorized pairing or memory corruption without user interaction. The company has not confirmed active exploitation of the iMessage or Bluetooth issues and provided no workarounds for users unable to update immediately.

The Hacker NewsNov 10, 2026Translated from English

Vulns & Exploits

SAP Patches Four CVSS 10.0 Flaws in NetWeaver, Web Dispatcher, Gateway and SAML

SAP released its November Security Patch Day fixes addressing four critical vulnerabilities, each rated CVSS 10.0, that require no authentication or user interaction to exploit. Two of the flaws, in the Internet Communication Manager and Web Dispatcher, allow remote code execution via crafted network traffic that corrupts memory. A third issue in the SAML 2.0 service provider permits attackers to impersonate any user, including privileged accounts, on systems using SAML single sign-on. The fourth flaw in SAP Gateway enables external attackers to bypass access controls and impersonate internal application servers. RedRays analysis stresses immediate kernel and Web Dispatcher updates across all instances and provides configuration guidance to reduce exposure until patches are applied.

The Hacker NewsNov 10, 2026Translated from English

Vulns & Exploits

CISA Adds Exploited IBM Aspera Faspex and SignalWire FreeSwitch Vulnerabilities to KEV Catalog

The Cybersecurity and Infrastructure Security Agency warned that threat actors are actively exploiting critical flaws in IBM Aspera Faspex and SignalWire FreeSwitch. CVE-2026-123218 is an authorization bypass in Aspera Faspex that allows authenticated users to obtain full administrative privileges via crafted messages. IBM released version 5.0.19 PL1 to address the issue. CVE-2026-116779 affects SignalWire FreeSwitch and enables code injection leading to sensitive data disclosure, arbitrary call control, and command execution with the privileges of the FreeSwitch process. Both vulnerabilities were added to the Known Exploited Vulnerabilities catalog, requiring federal agencies to apply patches within three days. CISA also highlighted ongoing exploitation of a critical GPUStack authentication bypass and the SSHole flaw in OpenSSH.

SecurityWeekNov 10, 2026Translated from English