Barracuda Networks warned customers to patch two vulnerabilities that can let attackers run commands with root privileges on affected devices. The company said one flaw is a critical Email Security Gateway authentication weakness, and the other allows threat actors with admin permissions to inject operating system commands that run as root.
Exposure depends on access to the administrative interfaces of the targeted devices. Barracuda said successful exploitation also requires that access, and it advised customers to use appropriate network access controls and limit exposure to trusted internal networks. Barracuda also said that if the two flaws are used together, they could let an attacker bypass authorization controls and obtain root access to the device.
Remediation and affected products
Barracuda said it immediately started a comprehensive remediation process and released security patches for affected products. Customers were told to review the affected products and remediation guidance, make sure their systems are on the latest firmware version, and apply all security patches. The company also listed the devices and patches in a table.
| Affected Product | CVE-2026-116606 | CVE-2026-111560 | Patch |
|---|---|---|---|
| Email Security Gateway (ESG) | Yes | Yes | BNSF-40425 (9.4.017+), BNSF-40430 (<9.4.017) |
| Load Balancer ADC | No | Yes | BNADC-16586 |
| Message Archiver (BMA) | No | Yes | BNMA-32468 |
| WAF Control Center (WCC) | No | Yes | BNWF-60060 |
| Web Application Firewall (WAF) | No | Yes | BNADC-16586 |
| Web Security Gateway (WSG) | No | Yes | BNYF-24789 |
Earlier Barracuda exploitation cases
Three years ago, Barracuda patched an Email Security Gateway flaw that the UNC4841 hacking group used in zero-day attacks to run arbitrary code on unpatched appliances. In the same year, UNC4841 also used another zero-day to target Barracuda ESG appliances in cyber-espionage attacks. Barracuda later said that vulnerability had been exploited for at least seven months, starting no later than October 2022, to deploy the SeaSpy and Saltwater malware and steal data from compromised systems.
Mandiant said almost one-third of the appliances hacked in the 2023 campaign belonged to government agencies worldwide. Most of those breaches happened between October and December 2022.
Barracuda background
Barracuda was founded in 2003 and says it has more than 200,000 customers worldwide. Those customers include small- to medium-sized businesses, large enterprises, and managed service providers.
Licensed under CC BY-ND 4.0 International