Barracuda Networks is urging customers to install security patches for two vulnerabilities that could allow attackers to run commands with root privileges on affected devices. The company says exploitation requires access to a targeted device’s administrative interface.
CVE-2026-116606 is a critical authentication flaw in the Email Security Gateway (ESG) that could let an attacker change an appliance’s global configuration. The second vulnerability, CVE-2026-111560, could allow someone with administrative permissions to inject operating-system commands that run as root. Barracuda says the flaws could be combined to bypass authorization controls and gain root access.
The vulnerabilities affect several Barracuda products. Both apply to the ESG, while CVE-2026-111560 also affects Load Balancer ADC, Message Archiver, WAF Control Center, Web Application Firewall and Web Security Gateway products.
Barracuda has released patches for affected systems. The ESG fixes are BNSF-40425 for version 9.4.017 and later, and BNSF-40430 for versions earlier than 9.4.017. The other fixes are BNADC-16586 for Load Balancer ADC and Web Application Firewall, BNMA-32468 for Message Archiver, BNWF-60060 for WAF Control Center, and BNYF-24789 for Web Security Gateway.
The company advises customers to check its remediation guidance, install the latest firmware and apply all available security patches. It also recommends using network access controls to limit administrative interfaces to trusted internal networks.
Sources: BleepingComputer.