Barracuda Networks has issued security patches for two vulnerabilities that can be chained together to grant attackers root-level control of several of its network and email security appliances.

The first flaw, CVE-2026-116606, is a critical authentication weakness in the Email Security Gateway (ESG) that allows attackers to modify an appliance’s global configuration. The second, CVE-2026-111560, lets a threat actor who already has admin permissions inject OS commands that execute with root privileges.

Barracuda noted that exploitation requires the attacker to already have access to the administrative interface of the targeted device. However, the company warned that combining the two flaws could allow an attacker to bypass authorization controls entirely and obtain full root access.

“Barracuda immediately initiated a comprehensive remediation process and released security patches for affected products,” the company said, urging customers to confirm they are running the latest firmware and have all relevant patches applied.

Affected Products and Patches

  • Email Security Gateway (ESG): affected by both CVEs. Patch BNSF-40425 (9.4.017+) or BNSF-40430 (prior versions)
  • Load Balancer ADC: affected by CVE-2026-111560. Patch BNADC-16586
  • Message Archiver (BMA): affected by CVE-2026-111560. Patch BNMA-32468
  • WAF Control Center (WCC): affected by CVE-2026-111560. Patch BNWF-60060
  • Web Application Firewall (WAF): affected by CVE-2026-111560. Patch BNADC-16586
  • Web Security Gateway (WSG): affected by CVE-2026-111560. Patch BNYF-24789

Barracuda also recommended customers apply network access controls and restrict administrative interface access to trusted internal networks to reduce exposure while patches are rolled out.

The warning comes against the backdrop of Barracuda’s history with ESG zero-days. Three years ago, the company patched CVE-2023-7102, which the espionage group UNC4841 exploited to run arbitrary code on unpatched appliances. That same group previously abused CVE-2023-2868, a flaw exploited for at least seven months starting around October 2022 to deploy the SeaSpy and Saltwater malware and exfiltrate data. Mandiant later found that nearly a third of the appliances compromised in that campaign belonged to government agencies worldwide.

Barracuda serves more than 200,000 customers globally, spanning small and medium businesses, large enterprises, and managed service providers, making prompt patching of administrative interfaces a priority for affected organizations.