Barracuda vulnerabilities could let attackers gain root access

Barracuda has warned customers to apply security updates after disclosing two vulnerabilities that can allow attackers to run commands with root privileges, according to BleepingComputer. The company says one flaw is in its Email Security Gateway and the other lets actors with admin permissions inject OS commands.

What Barracuda reported

BleepingComputer reports that Barracuda described two distinct issues. The first, CVE-2026-116606, stems from an Email Security Gateway authentication weakness that can let an attacker modify an appliance's global configuration. The second, CVE-2026-111560, permits command injection that results in OS commands running as root. Barracuda told customers it released security patches and that a full list of affected devices and available fixes is published alongside the advisory.

Barracuda also warned that "Successful exploitation requires an attacker to have access to the administrative interface of an affected product," according to BleepingComputer. The Hacker News notes the vulnerabilities could be chained to bypass authorization, and that the issues carry high severity ratings in published reports.

Which devices are affected

BleepingComputer and The Hacker News both lay out the product reach. CVE-2026-116606 affects the Email Security Gateway. CVE-2026-111560 impacts the Email Security Gateway and a set of other Barracuda appliances, including load balancer, message archiver, WAF control center, web application firewall, and web security gateway models. A table published with the advisory maps each CVE to the affected products and shows which patches are available.

If you manage any Barracuda appliances, review the vendor table closely to find exact firmware versions and the corresponding remediation steps before updating.

Why this matters for small organisations and public teams

Barracuda serves a wide range of customers, including small and medium businesses, managed service providers, and public sector organisations, BleepingComputer reports. A successful chain of these flaws could allow an attacker to bypass authorization controls and gain persistent root access on an appliance, which would let them run commands at the highest privilege level on that device.

There is relevant precedent: BleepingComputer notes Barracuda patched Email Security Gateway vulnerabilities in 2023 that were exploited by a threat group to run malware and exfiltrate data. That history shows appliances left unpatched can be attractive targets, especially when administrative interfaces are reachable.

Barracuda vulnerabilities: steps to take now

Do these actions promptly if you operate Barracuda appliances or if your IT team or vendor manages them:

• Verify which Barracuda products you have and match them against the vendor's published list of affected devices and patches. Apply the vendor-released security updates as instructed.
• If firmware on a device is multiple versions out of date, plan for staged updates; Barracuda notes some devices may require more than one firmware update to reach the latest release.
• Restrict access to administrative interfaces so they are not exposed to the public internet. Follow the vendor guidance to limit admin access to trusted internal networks.
• Use appropriate network access controls, such as firewall rules and VPNs, to reduce exposure of management ports.
• Review which accounts have administrative privileges and remove unnecessary admin access.
• After patching, monitor device logs and network traffic for unexpected behavior that could indicate prior compromise.

If you want to know how exposed your own site or perimeter is to this class of risk, start with a free external scan: Want to know how exposed your own site is? Start with a free external scan.

Monitoring, follow-up, and context

After applying patches, continue monitoring for signs of compromise. Barracuda's advisory and reporting do not state that these flaws are being widely exploited now, but past incidents involving Barracuda Email Security Gateway appliances were used in targeted campaigns, according to BleepingComputer. For organisations that outsource appliance management to an MSP, confirm that the provider has applied the patches and followed the vendor-recommended network restrictions.

Finally, keep firmware up to date as part of routine maintenance. The vendor reminder that multiple-step updates may be needed for older firmware highlights the importance of tracking appliance versions and planning updates so devices do not skip intermediate releases.

If you need a checklist to hand to your IT team or MSP, use the steps above and confirm each appliance is running the latest firmware from Barracuda and that administrative interfaces are properly blocked from untrusted networks.