Attackers Exploit Barracuda ESG Flaws for Root Access

Two critical flaws in Barracuda Email Security Gateway are being actively exploited to achieve root access on affected appliances. The vulnerabilities—one stemming from weak authentication, the other enabling unauthenticated command injection—allow attackers who reach the administrative interface to bypass security controls. Patches shipped last week, but exploitation has already begun against a small number of customers.

Barracuda advises customers to restrict Admin UI access to trusted networks and implement automatic patching. This incident follows a familiar pattern: a 2022 zero-day in the same product was leveraged for seven months before discovery, delivering custom malware and compromising roughly a third of victims—predominantly government agencies. With over 200,000 customers worldwide, Barracuda’s email security appliances remain a persistent target.