Barracuda warns of critical flaws allowing root access to devices

Barracuda Networks has urged customers to apply fixes for two severe vulnerabilities that, when chained together, could hand attackers root-level control of its appliances. CVE-2026-116606 is an authentication weakness in the Email Security Gateway (ESG) that lets an attacker alter the device's global settings, while CVE-2026-111560 allows an already-authenticated admin to inject OS commands executed as root. Exploiting either flaw still requires access to the appliance's admin panel, so Barracuda recommends restricting that interface to trusted internal networks and applying network access controls. Patches are already available across affected products including ESG, Load Balancer ADC, Message Archiver, WAF Control Center, Web Application Firewall, and Web Security Gateway, and the vendor is urging all 200,000+ customers to update firmware immediately given the company's history with previously exploited zero-days like CVE-2023-7102 and CVE-2023-2868.