Science & Tech · Cybersecurity · 3 hrs ago
Barracuda patches flaws that could give attackers root access
Barracuda Networks warned customers that two security flaws could give attackers root access to affected appliances.
One flaw affects the Email Security Gateway and can let attackers change its global configuration, while the other lets users with administrative permissions run operating-system commands as root.
Exploitation requires access to a device’s administrative interface, so Barracuda advises limiting that access to trusted internal networks.
The affected products include the Email Security Gateway, Load Balancer ADC, Message Archiver, WAF Control Center, Web Application Firewall and Web Security Gateway.
Barracuda has released firmware patches and urges customers to install them and ensure their systems are up to date.
The company has more than 200,000 customers worldwide, and its appliances were targeted in cyber-espionage attacks in 2023, making timely security updates important.
Barracuda Networks warned customers about two vulnerabilities that could allow attackers to run commands with root privileges on affected devices.
The company released security patches and urged customers to update their systems.
One flaw affects Email Security Gateway authentication and can allow changes to global configurations.
The other lets attackers with administrative permissions inject operating system commands that run as root.
Successful exploitation requires access to the administrative interface of an affected device.
- Who
- Barracuda Networks warned its customers about the vulnerabilities.
- What
- Two flaws could allow attackers to gain root access to affected devices; Barracuda released patches.
- When
- Barracuda issued the warning on November 3, 2026.
- Where
- Affected Barracuda appliances, including devices used worldwide.
- Why
- The vulnerabilities could let attackers bypass authorization controls and run commands with root privileges.
This story does not have two clearly opposing sides.
The vulnerability later identified as CVE-2023-2868 had been exploited since at least this time, according to Barracuda.
Barracuda patched flaws exploited in zero-day attacks against Email Security Gateway appliances.
Barracuda warned customers about two vulnerabilities and released patches for affected products.
- Vulnerability CVE-2026-116606
- Email Security Gateway authentication weakness that can allow changes to global configurations
- Vulnerability CVE-2026-111560
- Allows attackers with administrative permissions to inject operating system commands that run as root
- Affected products
- Email Security Gateway, Load Balancer ADC, Message Archiver, WAF Control Center, Web Application Firewall and Web Security Gateway
- Access needed
- Administrative interface access to an affected device
- Customer base
- More than 200,000 customers worldwide
3 sources
What people are saying
Successful exploitation requires an attacker to have access to the administrative interface of an affected product. If exploited in combination, these vulnerabilities could allow an attacker to bypass authorization controls and obtain root access to the device
Barracuda immediately initiated a comprehensive remediation process and released security patches for affected products. Customers should review the affected products and remediation guidance [..], ensure their systems are running the latest firmware version, and have all security patches applied.