Barracuda warns of critical flaws that grant root access to Email Security Gateway appliances
Barracuda Networks has urged customers to patch two vulnerabilities in its Email Security Gateway that, when exploited together, can let attackers bypass authorization controls and gain root access to devices. The company said exploitation requires access to a device's administrative interface and has released security patches for affected products.
BleepingComputer
Cybersecurity company Barracuda Networks is warning customers to patch two vulnerabilities in its Email Security Gateway (ESG) that can allow attackers to run commands with root privileges on affected appliances.
The first issue, tracked as CVE-2026-116606, is a critical flaw stemming from an authentication weakness that attackers can exploit to modify an appliance's global configuration. The second, CVE-2026-111560, lets threat actors with administrative permissions inject operating system commands that execute as root.
Barracuda noted that successful exploitation also requires access to the administrative interface of a targeted device. "If exploited in combination, these vulnerabilities could allow an attacker to bypass authorization controls and obtain root access to the device," the company explained.
To limit exposure, Barracuda advised customers to apply appropriate network access controls and restrict access to the administrative interfaces to trusted internal networks.
"Barracuda immediately initiated a comprehensive remediation process and released security patches for affected products," the company said, adding that customers should review the affected products and remediation guidance, ensure their systems are running the latest firmware version, and have all security patches applied. A complete list of affected devices and available patches was published alongside the advisory.
The warning comes three years after Barracuda patched an ESG flaw, CVE-2023-7102, that the UNC4841 hacking group exploited in zero-day attacks to execute arbitrary code on unpatched appliances.
The same year, UNC4841 abused another zero-day, CVE-2023-2868, to target Barracuda ESG appliances as part of cyber-espionage attacks. Barracuda later revealed that the vulnerability had been exploited for at least seven months, since at least October 2022, to deploy previously unknown SeaSpy and Saltwater malware and steal data from compromised systems.
According to cybersecurity firm Mandiant, almost a third of the appliances hacked in the 2023 campaign belonged to government agencies worldwide, with most of them breached between October and December 2022.
Founded in 2003, Barracuda serves more than 200,000 customers worldwide, including small and medium-sized businesses, large enterprises, and managed service providers.