Barracuda Networks said attackers have begun exploiting two Email Security Gateway flaws it patched about a week ago, in activity that can yield root-level command execution if the appliance admin interface is reachable¹.

BleepingComputer reported the warning Monday, citing Barracuda's updated advisory¹. The bugs are tracked as CVE-2026-116606 and CVE-2026-111560¹.

Barracuda described one issue as an ESG authentication weakness that can be used to change an appliance's global configuration, and the other as unauthenticated OS command injection that runs with root privileges¹. Combined, the company said, they could let an attacker bypass authorization controls and obtain root access¹.

Successful attacks require access to the administrative user interface, Barracuda said, and it advised customers to keep that interface on trusted internal networks with access controls¹.

The company said it started remediation and shipped patches, and that it had identified exploitation affecting a small number of organizations¹. If a patch was not applied automatically, Barracuda said customers should install it as soon as possible and turn automatic patching back on if they had disabled it¹.

BleepingComputer noted earlier ESG campaigns, including 2023 flaws attributed to UNC4841, as background; Barracuda did not publicly tie the new activity to a named group in the report¹. Who is exploiting the 2026 bugs, how they obtained Admin UI access, and which products or firmware builds were hit were not specified in the article¹.