Barracuda warns of critical flaws allowing root access to devices

Barracuda Networks disclosed two critical vulnerabilities in its Email Security Gateway (ESG) and other products that could allow attackers with access to administrative interfaces to bypass authorization controls and gain root-level command execution. The vulnerabilities, CVE-2026-116606 and CVE-2026-111560, affect multiple Barracuda appliances, with patches released for all impacted systems. The company urges customers to apply firmware updates immediately. Historical context includes prior exploitation of ESG flaws by the UNC4841 threat group, which used zero-days to deploy custom malware like SeaSpy and Saltwater in long-running espionage campaigns targeting government agencies and other organizations.

AI-extracted · verify before operational use