Barracuda warns of two flaws that could give attackers root access - Межа

Two vulnerabilities in Barracuda’s Email Security Gateway could let attackers bypass authorization controls and gain root access. Barracuda says exploitation requires access to a device’s administrative interface.

Barracuda Networks urged customers to patch two vulnerabilities that could let attackers run commands with root privileges.

This is reported by BleepingComputer .

The first, CVE-2026-116606, is a critical authentication flaw in the Email Security Gateway (ESG) that could let attackers modify an appliance’s global configuration. The second, CVE-2026-111560, allows threat actors with administrator permissions to inject operating system commands that run as root.

Barracuda said successful exploitation also requires access to the targeted device’s administrative interface. The company advised customers to use network access controls and limit access to trusted internal networks.

Successful exploitation requires an attacker to have access to the administrative interface of an affected product. If exploited in combination, these vulnerabilities could allow an attacker to bypass authorization controls and obtain root access to the device, – Barracuda

Successful exploitation requires an attacker to have access to the administrative interface of an affected product. If exploited in combination, these vulnerabilities could allow an attacker to bypass authorization controls and obtain root access to the device,

Barracuda said it began a comprehensive remediation process and released security patches for affected products. It urged customers to review the affected products and remediation guidance, install the latest firmware, and apply all security patches. The company said a table lists the affected devices and available patches.

In 2023, Barracuda patched another ESG vulnerability, CVE-2023-7102, which the UNC4841 hacking group had exploited in zero-day attacks to run arbitrary code on unpatched appliances. That year, UNC4841 also used a different zero-day, CVE-2023-2868, to target Barracuda ESG appliances in cyber-espionage attacks.

Barracuda later revealed that CVE-2023-2868 had been exploited for at least seven months, since at least October 2022, to deploy the previously unknown SeaSpy and Saltwater malware and steal data from compromised systems. According to cybersecurity firm Mandiant, almost a third of the appliances hacked in the 2023 campaign belonged to government agencies worldwide; most were breached between October and December 2022.

Other news you may find interesting:

The Louvre faced a massive 88 million euro jewel theft exposing long-standing cybersecurity and security system vulnerabilities dating back to 2014, highlighting urgent needs for modernization.