Cybersecurity
Barracuda warns of flaws that can grant root access
Barracuda Networks told customers to patch two vulnerabilities in its Email Security Gateway appliances after saying combined exploitation could let an attacker gain root access.
- Barracuda Networks said customers should install patches for two vulnerabilities in its Email Security Gateway products.
- It identified CVE-2026-116606 as an authentication weakness that could let an attacker alter an appliance’s global configuration.
- It identified CVE-2026-111560 as a flaw that could let someone with administrative access run commands as root.
- Barracuda said exploitation would still require access to a device’s administrative interface and that it had released patches and remediation guidance.
Barracuda Networks warned customers about two vulnerabilities in its Email Security Gateway appliances. It said one issue, CVE-2026-116606, could be used to change global configuration through an authentication weakness, while CVE-2026-111560 could allow command execution as root by someone with admin permissions.
The company said an attacker would still need access to the device’s administrative interface. It advised customers to use network access controls and to restrict exposure to trusted internal networks.
Barracuda said it had started remediation work and published security updates for affected products. It told customers to review the guidance, move to the latest firmware and apply all available patches.
The article also referred to earlier Barracuda ESG flaws that UNC4841 used in zero-day attacks in 2023. It said Barracuda later reported that one of those vulnerabilities had been exploited for at least seven months, and that Mandiant said almost a third of the hacked appliances belonged to government agencies worldwide.
Named in this story
Companies
- Barracuda Networks
- warned customers to patch two vulnerabilities
- Mandiant
- estimated the makeup of the 2023 victims
Organisations
- UNC4841
- used earlier Barracuda flaws in zero-day attacks
Products and systems
- Email Security Gateway
- was the Barracuda product line affected by the flaws
- SeaSpy
- was malware deployed in the earlier campaign
- Saltwater
- was malware deployed in the earlier campaign
How the source tells it
The piece is a plain security advisory with little emotive framing.
No emotive framing was found in the original.