Barracuda Networks has warned customers to patch two vulnerabilities in its products, one rated critical, that could, if exploited together, allow an attacker root access to a device. The cybersecurity company said the flaws affect its Email Security Gateway and several other appliances, and that patches have been released.
The critical flaw, tracked as CVE-2026-116606, stems from an authentication weakness in the Email Security Gateway (ESG) that attackers can exploit to modify an appliance's global configuration, according to the advisory reported by BleepingComputer. The second, CVE-2026-111560, lets threat actors with admin permissions inject operating system commands that run as root.
Barracuda said exploitation also requires access to the administrative interfaces of targeted devices, and advised customers to use appropriate network access controls and restrict access to trusted internal networks to limit exposure.
The warning comes three years after Barracuda patched an ESG flaw, CVE-2023-7102, that the UNC4841 hacking group exploited in zero-day attacks to execute arbitrary code on unpatched appliances. The same year, UNC4841 abused another zero-day, CVE-2023-2868, in cyber-espionage attacks, and Barracuda later revealed that vulnerability had been exploited for at least seven months, since at least October 2022, to deploy previously unknown SeaSpy and Saltwater malware and steal data from compromised systems. Cybersecurity firm Mandiant found that almost a third of the appliances hacked in the 2023 campaign belonged to government agencies worldwide, most of them breached between October and December 2022.
"Successful exploitation requires an attacker to have access to the administrative interface of an affected product. If exploited in combination, these vulnerabilities could allow an attacker to bypass authorization controls and obtain root access to the device," the company explained. "Barracuda immediately initiated a comprehensive remediation process and released security patches for affected products."
The Email Security Gateway is affected by both flaws, with fixes issued as BNSF-40425 (9.4.017+) and BNSF-40430 (9.4.017). The Load Balancer ADC, Message Archiver, WAF Control Center, Web Application Firewall and Web Security Gateway are listed as affected by CVE-2026-111560 only, with separate patch identifiers for each.
Barracuda, founded in 2003, says it has more than 200,000 customers worldwide, including small and medium-sized businesses, large enterprises and managed service providers. It told customers to check which products are affected, ensure systems are running the latest firmware version and apply all security patches.
Analysis
Why This Matters
- The flaws affect appliances that sit in front of email and web traffic, so a compromise could expose far more than the device itself.
- Barracuda's customer base spans small businesses, large enterprises and managed service providers, meaning a single unpatched appliance can sit in front of many downstream organisations.
- The company's own guidance makes clear that exposure depends on whether administrative interfaces are reachable, so network configuration is as important as patching here.
Background
Barracuda Networks is a US-headquartered cybersecurity vendor founded in 2003 that sells email, web and network security appliances. Its Email Security Gateway has been targeted before: in 2023 the company disclosed that a flaw in the product had been exploited for months in an espionage campaign attributed to the UNC4841 group, with researchers at Mandiant finding that government agencies made up a large share of the victims. Security appliances are attractive targets because they are typically internet-facing and hold privileged access to the networks behind them.
What to Watch
- Whether Barracuda or outside researchers report exploitation of either flaw in the wild; the advisory as reported describes the risk without citing attacks.
- Whether customers with administrative interfaces exposed to the internet act on the advice to restrict access to trusted internal networks.
- Firmware and patch levels on the Load Balancer ADC, Message Archiver, WAF Control Center, Web Application Firewall and Web Security Gateway, which carry the command injection flaw.
Key Perspectives
Barracuda Networks: says successful exploitation requires access to the administrative interface of an affected product, that the flaws in combination could allow an attacker to bypass authorization controls and obtain root access, and that it initiated a remediation process and released patches.
Checked
12 claims in this story checked against 1 source: 12 supported.
Show each claim
- SupportedThe headline says Barracuda warned customers to patch two flaws that could allow root access if exploited together.BleepingComputer: “Barracuda Networks warned customers to patch two vulnerabilities that can let attackers run commands with root privileges.”
- SupportedThe story quotes Barracuda saying the vulnerabilities could, if exploited in combination, bypass authorization controls and provide root access.BleepingComputer: “"Successful exploitation requires an attacker to have access to the administrative interface of an affected product. If exploited in combination, these vulnerabilities could allow an attacker to bypass authorization controls and obtain root access to the device,"”
- SupportedThe story quotes Barracuda saying it immediately began remediation and released security patches for affected products.BleepingComputer: “"Barracuda immediately initiated a comprehensive remediation process and released security patches for affected products.”
- SupportedSuccessful exploitation requires access to a targeted device’s administrative interface.BleepingComputer: “Barracuda said successful exploitation also requires access to the administrative interfaces of targeted devices”
- SupportedCVE-2026-116606 is a critical ESG authentication weakness that attackers can exploit to modify an appliance’s global configuration.BleepingComputer: “The first is a critical flaw ( CVE-2026-116606 ) stemming from an Email Security Gateway (ESG) authentication weakness that attackers can exploit to modify an appliance's global configuration”
- SupportedCVE-2026-111560 lets threat actors with admin permissions inject operating-system commands that run as root.BleepingComputer: “the second ( CVE-2026-111560 ) lets threat actors with admin permissions inject OS commands that run as root.”
- SupportedThe Load Balancer ADC, Message Archiver, WAF Control Center, Web Application Firewall and Web Security Gateway are listed as affected only by CVE-2026-111560.BleepingComputer: “Load Balancer ADC No Yes BNADC-16586 Message Archiver (BMA) No Yes BNMA-32468 WAF Control Center (WCC) No Yes BNWF-60060 Web Application Firewall (WAF) No Yes BNADC-16586 Web Security Gateway (WSG) No Yes BNYF-24789”
- SupportedThe Email Security Gateway is affected by both flaws, with fixes listed as BNSF-40425 (9.4.017+) and BNSF-40430 (9.4.017).BleepingComputer: “Email Security Gateway (ESG) Yes Yes BNSF-40425 (9.4.017+), BNSF-40430 ( 9.4.017)”
- SupportedThe story says Barracuda patched CVE-2023-7102 three years ago after UNC4841 exploited it in zero-day attacks to execute arbitrary code on unpatched appliances.BleepingComputer: “Three years ago, Barracuda also patched an Email Security Gateway flaw (CVE-2023-7102) that the UNC4841 hacking group exploited in zero-day attacks to execute arbitrary code on unpatched appliances.”
- SupportedThe story says UNC4841 abused CVE-2023-2868 in cyber-espionage attacks in the same year.BleepingComputer: “The same year, UNC4841 hackers abused another zero-day ( CVE-2023-2868 ) to target Barracuda ESG appliances as part of cyber-espionage attacks.”
- SupportedThe CVE-2023-2868 vulnerability was exploited for at least seven months, since at least October 2022, to deploy SeaSpy and Saltwater malware and steal data.BleepingComputer: “Barracuda later revealed that the vulnerability had been exploited for at least seven months , since at least October 2022, to deploy previously unknown SeaSpy and Saltwater malware and steal data from compromised systems.”
- SupportedMandiant found that almost a third of appliances hacked in the 2023 campaign belonged to government agencies worldwide, with most breached between October and December 2022.BleepingComputer: “Almost a third of appliances hacked in the 2023 campaign belonged to government agencies worldwide, most of them breached between October and December 2022, according to cybersecurity firm Mandiant.”