Barracuda warns of critical flaws allowing root access to devices

Cybersecurity company Barracuda Networks warned customers to patch two vulnerabilities that can let attackers run commands with root privileges. The first is a critical flaw (CVE-2026-116606) stemming from an Email Security Gateway (ESG) authentication weakness that attackers can exploit to modify an appliance's global configuration, while the second (CVE-2026-111560) lets threat actors with admin permissions inject OS commands that run as root. However, Barracuda said successful exploitation also requires access to the administrative interfaces of targeted devices and advised customers to use appropriate network access controls and restrict access to trusted internal networks to limit exposure. "Successful exploitation requires an attacker to have access to the administrative interface of an affected product. If exploited in combination, these vulnerabilities could allow an attacker to bypass authorization controls and obtain root access to the device," the company explained. "Barracuda immediately initiated a comprehensive remediation process and released security patches for affected products. Customers should review the affected products and remediation guidance [..], ensure their systems are running the latest firmware version, and have all security patches applied." A complete list of all affected devices and available security patches is available in the table below. Three years ago, Barracuda also patched an Email Security Gateway flaw (CVE-2023-7102) that the UNC484...