Barracuda Security Appliances Face Critical Vulnerabilities Allowing Root Access

Barracuda has disclosed two significant vulnerabilities in its security appliances that, if chained together, could allow threat actors to bypass authorisation controls and gain root access to devices.

The flaws consist of a pre-authentication authorisation bypass, tracked as CVE-2026-116606 (rated a 9.3 critical severity on the Common Vulnerability Scoring System), and a command injection vulnerability, tracked as CVE-2026-111560 (rated an 8.6 high severity).

Both vulnerabilities affect Barracuda’s Email Security Gateway (ESG). However, the command injection flaw (CVE-2026-111560) also impacts the company’s Web Security Gateway (WSG), Web Application Firewall (WAF), WAF Control Center (WCC), Load Balancer Application Delivery Controller (ADC), and Message Archiver (BMA).

Risk of Root Access and Credential Exposure

Gaining root access on an email gateway provides an attacker with control over every inbound and outbound message passing through the device. Frank Dickson of Dickson Research warned that such access could also expose the credentials and connections the gateway uses to reach mail servers and directories.

“Those are the keys to the kingdom, if you will,” Dickson said.

Jon Nelson, principal advisory director at Infotech, noted that assessing the two vulnerabilities in isolation may understate the actual risk. He explained that an attacker who can bypass authentication and then exploit command injection can move from accessing an exposed appliance to executing direct commands on it.

Mitigation and Patching Requirements

Barracuda has released security patches and advises customers to apply them immediately. The company noted that if a device’s firmware is multiple versions out of date, users may need to perform several sequential updates to reach the latest secure version.

Enterprises whose administrative interfaces are not publicly accessible from the internet are less exposed. Barracuda recommends restricting access to these interfaces to trusted internal networks and applying strict network access controls.

Dickson emphasised that once teams have limited admin access, they should verify that the patch was successfully installed rather than assuming it was. He further advised security leaders to review administrative logs for unauthorised visitors, check for unfamiliar accounts, and monitor for unexpected outbound connections from the devices.

Dickson also pointed out potential confusion in the company’s advisory, noting that while one flaw is described as “pre-authentication”, the advisory also lists administrative access as required. He suggested this likely means the condition is met if an administrative interface is exposed directly to the internet.

The Expanding Threat Landscape

The disclosure comes at a time when artificial intelligence is making it easier for attackers to identify software weaknesses and chain complex attacks together. Nelson noted that as vendors increasingly use AI to examine code, security leaders should expect more frequent flaw disclosures and shorter response windows.

This incident follows a 2023 zero-day vulnerability involving the same Email Security Gateway. During that incident, Barracuda advised customers with compromised appliances to replace the hardware entirely rather than relying on software patches.