**Barracuda Networks** has disclosed two significant vulnerabilities, urging customers to apply security patches to prevent potential root-level command execution by malicious actors. ### Critical Flaws Identified The first vulnerability, **CVE-2026-116606**, is a critical flaw found in the **Email Security Gateway (ESG)**. This authentication weakness could allow attackers to bypass authorization controls and modify an appliance's global configuration. The second, **CVE-2026-111560**, enables threat actors with administrative permissions to inject OS commands that run as root. ### Access Requirements and Mitigation **Barracuda** emphasizes that successful exploitation of these vulnerabilities requires attackers to gain access to the administrative interfaces of targeted devices. To mitigate this risk, the company advises customers to implement robust network access controls and restrict access to these interfaces to trusted internal networks only. In a statement, **Barracuda** explained: "Successful exploitation requires an attacker to have access to the administrative interface of an affected product. If exploited in combination, these vulnerabilities could allow an attacker to bypass authorization controls and obtain root access to the device." ### Immediate Remediation Advised **Barracuda** has already initiated a comprehensive remediation process, releasing security patches for all affected products. Customers are strongly advised to review the affected products and remediation guidance, ensuring their systems are running the latest firmware versions with all security patches applied. ### Affected Products and Patches The following table outlines the affected products and their corresponding patches: | Affected Product | CVE-2026-116606 | CVE-2026-111560 | Patch | | :-------------------------- | :-------------- | :-------------- | :--------------------- | | Email Security Gateway (ESG) | Yes | Yes | BNSF-40425 (9.4.017+), BNSF-40430 (<9.4.017) | | Load Balancer ADC | No | Yes | BNADC-16586 | | Message Archiver (BMA) | No | Yes | BNMA-32468 | | WAF Control Center (WCC) | No | Yes | BNWF-60060 | | Web Application Firewall (WAF) | No | Yes | BNADC-16586 | | Web Security Gateway (WSG) | No | Yes | BNYF-24789 | ### A History of Targeted Exploitation This isn't the first time **Barracuda** products have been in the crosshairs of threat actors. Three years prior, **Barracuda** patched an **Email Security Gateway** flaw (**CVE-2023-7102**) that the **UNC4841** hacking group exploited in zero-day attacks to execute arbitrary code on unpatched appliances. That same year, **UNC4841** abused another zero-day (**CVE-2023-2868**) to target **Barracuda ESG** appliances in cyber-espionage campaigns. **Barracuda** later disclosed that **CVE-2023-2868** had been actively exploited for at least seven months, dating back to October 2022. This exploitation led to the deployment of previously unknown malware, **SeaSpy** and **Saltwater**, and subsequent data theft from compromised systems. Cybersecurity firm **Mandiant** reported that almost a third of the appliances compromised in the 2023 campaign belonged to government agencies worldwide, with most breaches occurring between October and December 2022. **Barracuda**, founded in 2003, serves over 200,000 customers globally, including small to medium-sized businesses (SMBs), large enterprises, and managed service providers (MSPs). The repeated targeting of their products underscores the persistent and sophisticated nature of modern cyber threats, making timely patching and robust security practices paramount for all users.