UNC4841

Attackers Exploit Critical Barracuda ESG Vulnerabilities for Root Access

Barracuda Networks has warned that threat actors are actively exploiting two recently patched vulnerabilities in its Email Security Gateway appliances. The flaws, tracked as CVE-2026-116606 and CVE-2026-111560, allow attackers to modify global configurations and execute operating system commands with root privileges. Exploitation requires access to the administrative user interface, prompting Barracuda to advise restricting Admin UI exposure to trusted internal networks. The company confirmed limited attacks against a small number of customers and urged immediate application of patches such as BNSF-40425. Historical context shows UNC4841 previously targeted similar Barracuda ESG zero-days, including CVE-2023-7102 and CVE-2023-2868, to deploy SeaSpy and Saltwater malware. Mandiant reported that nearly one-third of victims in the 2023 campaign were government agencies. Barracuda recommends enabling automatic patching to mitigate further risk across affected products including Load Balancer ADC and Web Application Firewall.