Barracuda warns of critical flaws allowing root access to devices

Barracuda Networks urged customers to apply patches for two vulnerabilities that can let attackers execute commands with root privileges on affected devices.

CVE-2026-116606 is a critical authentication weakness in the Email Security Gateway (ESG) that permits an attacker to modify an appliance's global configuration. CVE-2026-111560 allows an actor with admin permissions to inject OS commands that run as root.

Barracuda stated that an attacker must reach the administrative interface of a vulnerable device. The company told customers to use network access controls and limit access to trusted internal networks in order to reduce exposure. "Successful exploitation requires an attacker to have access to the administrative interface of an affected product. If exploited in combination, these vulnerabilities could allow an attacker to bypass authorization controls and obtain root access to the device," Barracuda explained.

Barracuda said it immediately started a remediation process and released security patches. The company urged customers to review affected products, run the latest firmware, and apply all security patches. The advisory lists the Email Security Gateway as affected by both flaws, while Load Balancer ADC, Message Archiver, WAF Control Center, Web Application Firewall, and Web Security Gateway are affected by CVE-2026-111560 only. Patch identifiers include BNSF-40425 (9.4.017 and later) and BNSF-40430 (before 9.4.017) for ESG, BNADC-16586 for Load Balancer ADC and WAF, BNMA-32468 for Message Archiver, BNWF-60060 for WAF Control Center, and BNYF-24789 for Web Security Gateway. The Email Security Gateway is the only product affected by both vulnerabilities; the other five products are affected only by the command injection flaw. Barracuda also asked customers to review remediation guidance. The advisory is available on Barracuda's trust portal.

Earlier, in 2023, Barracuda fixed an Email Security Gateway flaw, CVE-2023-7102, which the UNC4841 group used in zero-day attacks to run arbitrary code on unpatched appliances. That same year, UNC4841 exploited another zero-day, CVE-2023-2868, in cyber-espionage attacks against Barracuda ESG devices. Barracuda later said the flaw had been exploited since at least October 2022, for seven months or more, to install SeaSpy and Saltwater malware and exfiltrate data. According to Mandiant, almost a third of the appliances hacked in that campaign belonged to government agencies, and most were compromised between October and December 2022.

Barracuda, established in 2003, serves over 200,000 customers globally, including SMBs, large enterprises, and MSPs.