Barracuda Warns of Critical Security Flaw That Could Grant Root Access to Devices

Barracuda Networks has urged customers to install security updates for two vulnerabilities that could allow attackers to bypass authentication controls, inject operating system commands and gain root privileges on affected appliances. Exploitation requires access to a targeted device’s management interface, but the company recommends restricting that interface to trusted internal networks and applying the latest firmware and patches.

Barracuda vulnerabilities enable root-level access

The first vulnerability, CVE-2026-116606, is a serious flaw in the authentication mechanisms of Barracuda’s Email Security Gateway (ESG). An attacker could exploit it to modify the appliance’s global configuration.

The second vulnerability, CVE-2026-111560, can be exploited by an attacker who already has administrative privileges to inject operating system commands. Those commands are executed with root privileges.

Barracuda said successful exploitation of either vulnerability requires access to the management interface of an affected product. The company advised customers to implement appropriate network access controls and limit management access to trusted internal networks.

“Successful exploitation requires the attacker to have access to the management interface of the affected product. Exploitation of these vulnerabilities in combination could allow the attacker to bypass authentication controls and gain root access to the device,” Barracuda explained.

Barracuda said it “immediately initiated a comprehensive remediation process” and released security patches for affected products. The company told customers to review its affected-product list and remediation guidance, ensure their systems are running the latest firmware versions, and confirm that all security patches have been installed.

Affected Barracuda products and patches

The affected products and corresponding patch identifiers are listed below.

Barracuda appliances have been targeted before

In 2023, Barracuda patched an Email Security Gateway vulnerability, CVE-2023-7102, after the UNC4841 hacking group exploited it as a zero-day to execute arbitrary code on unpatched appliances.

That same year, UNC4841 exploited another zero-day, CVE-2023-2868, against Barracuda ESG appliances in a cyberespionage campaign.

Barracuda later revealed that attackers had exploited the vulnerability for at least seven months, beginning no later than October 2022. The campaign deployed the previously unknown SeaSpy and Saltwater malware and stole data from compromised systems.

According to cybersecurity company Mandiant, nearly one-third of the devices compromised in the 2023 campaign belonged to government agencies around the world. Most of the compromises occurred between October and December 2022.

Founded in 2003, Barracuda has more than 200,000 customers worldwide, including small and medium-sized businesses, large enterprises and managed service providers.

Source: www.bleepingcomputer.com