Barracuda critical flaws allow root access to devices
Original title: Barracuda warns of critical flaws allowing root access to devices
Two critical vulnerabilities in Barracuda ESG and related products could enable root access; patches released for affected versions.
Barracuda Networks identified two critical vulnerabilities allowing attackers to obtain root access to devices if administrative interfaces are exposed. CVE-2026-116606 involves an authentication weakness in the Email Security Gateway that could modify global configuration. CVE-2026-111560 permits command injection as root for users with admin permissions. The company released patches and urges customers to restrict access to trusted networks only.
Unconfirmed: Exploitation status of the new CVEs is not stated
- CVE-2026-116606 affects Email Security Gateway
- CVE-2026-111560 impacts Load Balancer ADC, Message Archiver, WAF and Web Security Gateway
- Patches available for firmware 9.4.017 and later
- Exploitation requires administrative interface access
Impact: root access to devices
- 1.apply security patches
- 2.restrict administrative interface access
- Vendors
- Barracuda Networks
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-111560 | Command Injection in Barracuda Appliance Timezone Field | 8.6 | — | ||
| CVE-2026-116606 | Auth bypass in Barracuda Email Security Gateway before 9.4.0.030 | 9.3 | — |
From the original article
2 min read at bleepingcomputer.com
Cybersecurity company Barracuda Networks warned customers to patch two vulnerabilities that can let attackers run commands with root privileges. [...]
By Sergiu Gatlan · bleepingcomputer.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.