Cybersecurity company Barracuda Networks warned customers to patch two vulnerabilities that can let attackers run commands with root privileges.
The first is a critical flaw (CVE-2026-116606) stemming from an Email Security Gateway (ESG) authentication weakness that attackers can exploit to modify an appliance's global configuration, while the second (CVE-2026-111560) lets threat actors with admin permissions inject OS commands that run as root.
However, Barracuda said successful exploitation also requires access to the administrative interfaces of targeted devices and advised customers to use appropriate network access controls and restrict access to trusted internal networks to limit exposure.
"Successful exploitation requires an attacker to have access to the administrative interface of an affected product. If exploited in combination, these vulnerabilities could allow an attacker to bypass authorization controls and obtain root access to the device," the company explained.
"Barracuda immediately initiated a comprehensive remediation process and released security patches for affected products. Customers should review the affected products and remediation guidance [..], ensure their systems are running the latest firmware version, and have all security patches applied."
A complete list of all affected devices and available security patches is available in the table below.
| Affected Product | CVE-2026-116606 | CVE-2026-111560 | Patch |
|---|---|---|---|
| Email Security Gateway (ESG) | Yes | Yes | BNSF-40425 (9.4.017+), BNSF-40430 (<9.4.017) |
| Load Balancer ADC | No | Yes | BNADC-16586 |
| Message Archiver (BMA) | No | Yes | BNMA-32468 |
| WAF Control Center (WCC) | No | Yes | BNWF-60060 |
| Web Application Firewall (WAF) | No | Yes | BNADC-16586 |
| Web Security Gateway (WSG) | No | Yes | BNYF-24789 |
Three years ago, Barracuda also patched an Email Security Gateway flaw (CVE-2023-7102) that the UNC4841 hacking group exploited in zero-day attacks to execute arbitrary code on unpatched appliances.
The same year, UNC4841 hackers abused another zero-day (CVE-2023-2868) to target Barracuda ESG appliances as part of cyber-espionage attacks.
Barracuda later revealed that the vulnerability had been exploited for at least seven months, since at least October 2022, to deploy previously unknown SeaSpy and Saltwater malware and steal data from compromised systems.
Almost a third of appliances hacked in the 2023 campaign belonged to government agencies worldwide, most of them breached between October and December 2022, according to cybersecurity firm Mandiant.
Founded in 2003, Barracuda has more than 200,000 customers worldwide, including small- to medium-sized businesses (SMBs), large enterprises, and managed service providers (MSPs).
Adaptive Security's AI agents analyze email intent, context, and behavior to uncover phishing, business email compromise, and invoice fraud.
See what's getting through with a 14-day read-only scan of Microsoft 365 or Google Workspace, with no MX changes.