Barracuda Networks warned customers to patch two vulnerabilities. The first, CVE-2026-116606, is critical: an authentication weakness in the Email Security Gateway that lets an attacker modify the appliance's global configuration. The second, CVE-2026-111560, lets someone with admin permissions inject OS commands that run as root. According to the company, combined they could allow an attacker to bypass authorization controls and gain root access.
According to Barracuda, exploitation requires access to the device's administrative interface. The company has released patches for the affected products and published a list of them.
What to do: make sure devices run the latest firmware with all patches applied, and restrict access to admin interfaces to trusted internal networks. Barracuda has more than 200,000 customers. In 2023, an espionage group exploited flaws in the company's ESG appliances for months, and about a third of the appliances breached then belonged to government agencies.