Barracuda Patches Chainable Flaws Giving Root Access
Barracuda fixed CVE-2026-116606 and CVE-2026-111560, which together can bypass authorization and yield root. Restrict admin interfaces and patch now.
Marisol "Fuse" DelgadoBarracuda has patched two vulnerabilities that, chained together, let an attacker bypass authorization and run commands as root on affected appliances. Both are fixed. The exposure question comes down to one thing: can anyone reach your admin interface?
What changed
BleepingComputer reports that CVE-2026-116606 is a critical authentication weakness in Email Security Gateway (ESG) that lets an attacker modify the appliance’s global configuration. CVE-2026-111560 lets someone with admin permissions inject OS commands that run as root.
The Hacker News describes the first as a pre-authentication authorization bypass and the second as a command injection. CVE-2026-116606 affects only ESG. CVE-2026-111560 also affects:
- Load Balancer ADC
- Message Archiver
- WAF Control Center
- Web Application Firewall
- Web Security Gateway
Barracuda says exploitation requires access to the administrative interface. The cited reporting does not say either flaw is exploited in the wild.
What to do
- Pull admin interfaces off the internet. Barracuda’s own guidance is to restrict administrative access to trusted internal networks and apply network access controls. This is the single highest-value step, since the chain depends on reaching that interface.
- Patch. BleepingComputer lists these fixes from Barracuda’s table: BNSF-40425 (ESG 9.4.017 and later) or BNSF-40430 (ESG before 9.4.017), BNADC-16586 (Load Balancer ADC and WAF), BNMA-32468 (Message Archiver), BNWF-60060 (WAF Control Center), BNYF-24789 (Web Security Gateway).
- Check firmware currency. Barracuda warns that a device several versions behind may need more than one update.
Priority call
Patch ESG first. It is the only product exposed to both flaws, so it is the only one where the full chain applies. The other five products carry the command injection alone, which needs admin access to begin with. If your admin UI is already limited to a management network, the rest can follow your normal patch window.
ESG also has history. Barracuda patched CVE-2023-7102 and CVE-2023-2868 in 2023, both exploited in the UNC4841 campaigns against these appliances. That does not make today’s flaws exploited, but it is a reason not to let an ESG sit unpatched with a reachable admin port.
More on the vendor is on the Barracuda hub.
Found this useful? Share it.
