Barracuda Patches Critical Root Access Flaws in Email Gateways

Barracuda Networks has warned of two critical vulnerabilities in its Email Security Gateway products. The first (CVE-2026-116606) exploits an authentication weakness allowing configuration modifications, while the second (CVE-2026-111560) permits root-level command injection by admin users. Both require attackers to access administrative interfaces. The company has released patches and recommends restricting admin access to trusted networks.

The warnings follow a pattern of similar attacks. In 2023, Barracuda disclosed that UNC4841 had exploited two separate zero-day flaws: CVE-2023-7102 to execute arbitrary code, and CVE-2023-2868 to conduct cyber-espionage. The CVE-2023-2868 campaign began in October 2022 and persisted for at least seven months, with attackers deploying SeaSpy and Saltwater malware. Nearly a third of the compromised appliances belonged to government agencies worldwide, with most breached between October and December 2022. Barracuda currently serves over 200,000 customers globally.