Barracuda patches two chainable root flaws in email gateways

Barracuda Networks has told customers to patch two vulnerabilities that can be chained to run commands as root on its Email Security Gateway appliances. Successful exploitation requires access to the appliance’s administrative interface; combined, the two bugs let an attacker bypass authorization controls and obtain full control.

The first, CVE-2026-116606, is a critical authentication weakness in the ESG. It lets an attacker modify the appliance’s global configuration. The second, CVE-2026-111560, lets someone with admin permissions inject operating system commands that execute as root. On their own each is bounded: the config flaw is an authorization problem, and the command injection assumes you already hold admin. Used together they let an attacker bypass the authorization controls and reach root. In Barracuda’s words, “If exploited in combination, these vulnerabilities could allow an attacker to bypass authorization controls and obtain root access to the device.”

The mitigating condition is the administrative interface. Barracuda says successful exploitation requires access to it, and its advice is the obvious one: use network access controls and restrict the admin interface to trusted internal networks. That is a real constraint, not a get-out-of-patching card. An ESG whose management plane is reachable from a flat internal network, a VPN segment shared with user workstations, or anything an attacker can pivot to after an initial foothold is still in scope. Treat the “requires admin interface access” line as a reason to check where that interface is actually exposed, then patch anyway.

Barracuda says it released security patches for the affected products and is pointing customers at a per-device table of affected models and fixes. Run the latest firmware and apply the patches; if you operate several ESG models, work from that table rather than assuming one version covers your fleet.

The reason this gets attention beyond a routine advisory is history. Three years ago Barracuda patched CVE-2023-7102, which the group tracked as UNC4841 exploited as a zero-day to execute arbitrary code on unpatched ESG appliances. The same year, UNC4841 abused another zero-day, CVE-2023-2868, to target ESG appliances in a cyber-espionage campaign. Barracuda later said that flaw had been exploited since at least October 2022, roughly seven months before disclosure, to deploy the SeaSpy and Saltwater malware families and steal data from compromised systems. Mandiant reported that almost a third of the appliances compromised in that 2023 campaign belonged to government agencies worldwide, most of them breached between October and December 2022.

What the 2023 campaign established is that ESG appliances are a proven target for a capable, patient actor, and that a root-access bug on the device is worth taking seriously even when the entry condition is admin-interface access.

The sensible posture is to patch to current firmware now, confirm the management interface is not reachable from untrusted or broadly accessible networks, and review admin accounts on these boxes given that the second bug turns any admin foothold into root. Barracuda, founded in 2003, reports more than 200,000 customers across SMBs, large enterprises and managed service providers.