Barracuda warns of flaws that could give attackers root access

Barracuda Networks warned customers to patch two vulnerabilities that could let attackers run commands with root privileges on affected devices.

The first, CVE-2026-116606, is a critical flaw tied to an authentication weakness in the company’s Email Security Gateway (ESG). Attackers could exploit it to change an appliance’s global configuration. The second, CVE-2026-111560, could let attackers who already have administrator permissions inject operating system commands that run as root.

Barracuda said successful exploitation requires access to the administrative interfaces of targeted devices. It said exploiting the flaws together could allow an attacker to bypass authorization controls and obtain root access. The company said it had started a remediation process and released patches for affected products. It advised customers to review its affected-product and remediation guidance, install the latest firmware, apply all security patches, and restrict administrative access to trusted internal networks.

Barracuda has previously faced attacks exploiting flaws in its ESG appliances. In 2023, the company patched CVE-2023-7102, which the UNC4841 hacking group exploited in zero-day attacks to run arbitrary code on unpatched appliances. That year, UNC4841 also exploited CVE-2023-2868. Barracuda later said that flaw had been exploited for at least seven months, since at least October 2022, to deploy SeaSpy and Saltwater malware and steal data. Mandiant said almost a third of appliances hacked in the 2023 campaign belonged to government agencies worldwide.