CriticalCVE
Barracuda warns of critical flaws allowing root access to devices
BleepingComputer·Source published ·1 min read
What happened?
Cybersecurity company Barracuda Networks warned customers to patch two vulnerabilities that can let attackers run commands with root privileges. [...]
Key details
- First flaw is an authentication weakness in Email Security Gateway letting attackers change global configuration.
- Second flaw lets admins inject OS commands that execute with root privileges.
- Exploitation requires access to the administrative interface of the targeted device.
- Barracuda released security patches for all affected products and urges customers to apply them.
- Multiple product lines are affected including Load Balancer ADC, Message Archiver, WAF Control Center, Web Application Firewall, and Web Security Gateway.
Affected
- Email Security Gateway (ESG) affected by both CVE-2026-116606 and CVE-2026-111560.
- Load Balancer ADC affected by CVE-2026-111560.
- Message Archiver (BMA) affected by CVE-2026-111560.
- WAF Control Center (WCC) affected by CVE-2026-111560.
- Web Application Firewall (WAF) affected by CVE-2026-111560.
- Web Security Gateway (WSG) affected by CVE-2026-111560.
Summarised by SecOraLens from BleepingComputer. Always read the original source before acting. How SecOraLens verifies advisories.