Barracuda warns of critical flaws allowing root access to devices

Cybersecurity firm Barracuda Networks has issued an urgent warning to its customers, urging them to patch two newly discovered vulnerabilities in its products. These security flaws could potentially allow malicious actors to execute arbitrary commands with root privileges on targeted hardware. Ensuring timely firmware updates remains critical for enterprise security.

• CVE-2026-116606 is an ESG authentication flaw allowing attackers to modify global appliance configurations.
• CVE-2026-111560 lets threat actors with admin permissions inject OS commands that run as root.
• Successful exploitation requires the attacker to have access to the administrative interface.
• Barracuda has released immediate security patches and firmware updates to remediate the risks.

The first issue, tracked as CVE-2026-116606, stems from an Email Security Gateway (ESG) authentication weakness that allows attackers to alter an appliance's global configuration settings. The second vulnerability, designated as CVE-2026-111560, enables threat actors possessing administrative permissions to inject operating system commands that execute with full root privileges.

However, Barracuda noted that a successful exploit requires the attacker to already have access to the administrative interface of the affected product. The company advises customers to employ appropriate network access controls and restrict administrative access strictly to trusted internal networks to limit exposure. Proper network segmentation serves as a strong secondary defense.

Barracuda immediately initiated a comprehensive remediation process and released security patches for all affected products. Customers are strongly advised to review the remediation guidance, ensure their systems are running the latest firmware versions, and apply all necessary security patches promptly. The company has a history of addressing critical ESG vulnerabilities dating back to major incidents in 2023.