Critical Root‑Access Vulnerabilities Discovered in Barracuda Email Security Gateway and Other Appliances (CVE‑2026‑116606, CVE‑2026‑111560)
What Happened — Barracuda Networks disclosed two critical vulnerabilities that can give an attacker root‑level command execution on several of its security appliances.
- CVE‑2026‑116606 is an authentication weakness in the Email Security Gateway (ESG) that lets an attacker modify the appliance’s global configuration.
- CVE‑2026‑111560 allows any user with administrative privileges on affected devices (ESG, Load Balancer ADC, Message Archiver, WAF Control Center, Web Application Firewall, Web Security Gateway) to inject OS commands that run as root.
Exploitation requires prior access to the administrative interface of the target device. Barracuda recommends network‑level segmentation, strict access controls, and immediate patching. Patches (e.g., BNSF‑40425, BNADC‑16586) are now available for all listed products. The company also reminded customers of a prior ESG zero‑day (CVE‑2023‑7102) that was leveraged by the UNC4841 group for espionage, underscoring the long‑term risk of unpatched admin interfaces.
Why It Matters for Trust & Control Assurance — The flaws highlight the need for robust access‑control policies that isolate privileged interfaces and enforce least‑privilege, a core control objective across most governance frameworks.
Who Is Affected — Organizations that deploy Barracuda ESG, load balancers, archivers, or web firewalls – including SMBs, large enterprises, and managed service providers (MSPs) across all verticals.
Recommended Actions
- Inventory all Barracuda appliances and verify firmware versions.
- Apply the released patches immediately (see Barracuda advisory).
- Restrict administrative interfaces to trusted internal networks or VPNs; enforce network segmentation.
- Enable multi‑factor authentication (MFA) for all admin accounts.
- Document patch status and network‑segmentation controls as audit evidence.
Technical Notes
- Attack vector: exploitation of authentication weakness and privileged‑command injection.
- CVEs: CVE‑2026‑116606 (critical), CVE‑2026‑111560 (critical).
- Potential impact: full system compromise with root privileges if admin interface is reachable.
- Related history: UNC4841 leveraged a 2023 ESG zero‑day (CVE‑2023‑7102) for espionage; similar supply‑chain risk patterns observed.
Source: BleepingComputer article