Barracuda alerts customers to flaws that can give attackers root access to enterprise appliances

Barracuda Networks has released security patches after warning customers about two vulnerabilities that attackers can chain together to execute commands with root privileges. The issues include CVE-2026-116606, a critical authentication flaw in Email Security Gateway appliances that allows attackers to modify global configurations, and CVE-2026-111560, a command injection vulnerability that lets administrators run operating system commands as root. [1][2]

Barracuda says successful attacks require access to a device's administrative interface, meaning an intruder must reach that panel before exploiting the bugs. Beyond the Email Security Gateway, the command injection vulnerability also impacts several other Barracuda lines, including Load Balancer ADC, Message Archiver, WAF Control Center, Web Application Firewall, and Web Security Gateway appliances. The company is urging administrators to install the relevant firmware patches and restrict admin interface access strictly to trusted internal networks. [2]

The fixes follow earlier high-profile intrusions against Barracuda equipment, including a zero-day flaw in 2023 linked by cybersecurity firm Mandiant to the hacking group UNC4841. That earlier espionage campaign breached appliances for months, deploying custom malware and affecting systems across global government agencies, small businesses, and enterprises. [2]