Skip to content
Barracuda Products Vulnerable to Critical Flaws Allowing Root Access

Barracuda Products Vulnerable to Critical Flaws Allowing Root Access

First seen 3 Nov 2026, 15:45 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •November 3, 2026 at 18:16 UTC
  • •Two critical vulnerabilities (CVEs) in Barracuda products could allow root access.
  • •Successful exploitation requires access to the administrative interfaces of affected devices.
  • •Barracuda has released patches and urges immediate action to secure systems.

Barracuda Networks disclosed two critical vulnerabilities on November 2, 2026, affecting several of its products, including the Email Security Gateway (ESG). The vulnerabilities, CVE-2026-116606 (CVSS 9.3) and CVE-2026-111560 (CVSS 8.6), could allow attackers to bypass authorization controls and execute commands with root privileges if they gain access to the administrative interfaces. Organizations are advised to restrict access to these interfaces and apply the released patches promptly. The flaws have not yet been reported as. Barracuda has urged customers to ensure their systems are updated with the latest firmware and security patches to mitigate risks. Affected products include ESG, Load Balancer ADC, Message Archiver, WAF Control Center, Web Application Firewall, and Web Security Gateway. The company has provided specific patch numbers for each affected product to facilitate remediation.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2023-05-24
CVE-2023-2868 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2023-12-24
CVE-2023-7102 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-11-02
CVE-2026-116606 and CVE-2026-111560 disclosed
Barracuda disclosed two critical vulnerabilities affecting several products, including ESG, with CVSS scores of 9.3 and 8.6.
Finance.Biggo
2026-11-02
Patches released for affected products
Barracuda released security patches for the affected products and advised customers to apply them immediately.
Bleepingcomputer

More articles in this cluster (8)

Following this threat?

Track barracuda, UNC4841 and Saltwater in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (17)

1 / 4

Common questions

Which Barracuda products are affected?
The affected products include Email Security Gateway, Load Balancer ADC, Message Archiver, WAF Control Center, Web Application Firewall, and Web Security Gateway.
What should I do to protect my systems?
Restrict access to the administrative interfaces to trusted internal networks and apply the latest patches provided by Barracuda.
Have these vulnerabilities been exploited in the wild?
As of now, there have been no confirmed reports of exploitation of these vulnerabilities.