Barracuda Patches Two Flaws That Could Enable Root Access to Devices
Summary
Barracuda disclosed two vulnerabilities that could enable root access to affected devices and released patches. Exploitation requires access to administrative interfaces; customers should restrict access and update firmware.
Key points
- CVE-2026-116606 is an authentication weakness in Email Security Gateway that can let attackers modify an appliance’s global configuration.
- CVE-2026-111560 allows users with administrative permissions to inject operating-system commands that run as root.
- Barracuda says exploitation requires access to an affected product’s administrative interface; combining the flaws could bypass authorization controls and provide root access.
- Affected products include Email Security Gateway, Load Balancer ADC, Message Archiver, WAF Control Center, Web Application Firewall, and Web Security Gateway.
- Barracuda released product-specific patches and advises customers to apply the latest firmware and restrict administrative access to trusted internal networks.
Article Details
- Vulnerability Types
- Authentication weakness
- OS command injection
- Severity
- Critical
- Exploitation Status
- unknown
- Exploit Availability
- unknown
- Patch Status
- available
- Workarounds
- Restrict access to administrative interfaces to trusted internal networks using appropriate network access controls.
- Ensure systems run the latest firmware version and have all security patches applied.
MITRE ATT&CK
T1059 · Command and Scripting InterpreterCVE-2026-111560 allows an administrator with access to the device to inject OS commands.T1068 · Exploitation for Privilege EscalationThe article says the vulnerabilities, if exploited in combination, could bypass authorization controls and provide root access to the device.
CVE
CVE-2023-2868Barracuda · Email security gateway 300 firmware; Barracuda · Email security gateway 400 firmware; +3 moreThe same year, UNC4841 hackers abused another zero-day (CVE-2023-2868) to target Barracuda ESG appliances as part of cyber-espionage attacks.CVE-2023-7102Barracuda · Email security gateway 300 firmware; Barracuda · Email security gateway 400 firmware; +3 moreThree years ago, Barracuda also patched an Email Security Gateway flaw (CVE-2023-7102) that the UNC4841 hacking group exploited in zero-day attacks to execute arbitrary code on unpatched appliances.CVE-2026-111560Barracuda Networks · Barracuda Email Security Gateway (ESG); Barracuda Networks · Barracuda Load Balancer Application Delivery Controller (ADC); +4 moreweakness that attackers can exploit to modify an appliance's global configuration, while the second (CVE-2026-111560) lets threat actors with admin permissions inject OS commands that run as root.CVE-2026-116606Barracuda Networks · Barracuda Email Security Gateway (ESG)The first is a critical flaw (CVE-2026-116606) stemming from an Email Security Gateway (ESG) authentication weakness that attackers can exploit to modify an appliance's global configuration, while the second
Threat Actors
Malware
Saltwaterfor at least seven months, since at least October 2022, to deploy previously unknown SeaSpy and Saltwater malware and steal data from compromised systems.SeaSpyhad been exploited for at least seven months, since at least October 2022, to deploy previously unknown SeaSpy and Saltwater malware and steal data from compromised systems.