Bleeping Computer reports that Barracuda Networks has issued an urgent warning to customers regarding two security vulnerabilities that could allow unauthorized attackers to execute commands with root privileges on various appliances.
The first issue, identified as CVE-2026-116606, involves an authentication weakness in the Email Security Gateway that permits attackers to modify global configurations. The second flaw, CVE-2026-111560, enables threat actors with administrative permissions to inject operating system commands that run as root. Barracuda stated that successful exploitation requires access to the administrative interfaces of the targeted devices. Consequently, the company recommends that users implement strict network access controls and limit exposure to trusted internal networks only. The affected product lineup includes the Email Security Gateway, Load Balancer ADC, Message Archiver, WAF Control Center, Web Application Firewall and Web Security Gateway. Barracuda has released firmware updates to remediate these risks and urges all customers to apply the patches immediately. This development follows previous security incidents involving the company, including zero-day exploits in 2023 that were linked to cyber-espionage campaigns. With over 200,000 customers globally, including government agencies and large enterprises, the company emphasizes the importance of maintaining updated systems to prevent potential unauthorized access and data theft.
Source: Bleeping Computer
