Barracuda, which offers a wide variety of cybersecurity devices, has been bitten by a bug itself.
The company has disclosed two critical and high-severity vulnerabilities that, if chained together, could allow threat actors to bypass authorization controls and gain root access to devices.
They consist of a pre-authentication authorization bypass vulnerability, tracked as CVE-2026-116606 (rated a critical 9.3 severity on the common vulnerability scoring system), and a command injection vulnerability tracked as CVE-2026-111560 (rated an 8.6 high-severity on CVSS). Attackers need to have access to the admin interface of a susceptible device to successfully exploit these vulnerabilities.
Barracuda has released security patches, which it advises customers to apply immediately.
The vulnerabilities impact numerous popular Barracuda products
Root access on an email gateway puts the attacker in the place that every inbound and outbound message passes, said Frank Dickson of Dickson Research. It may also expose the credentials and connections the gateway uses to reach the mail server and directory. “Those are the keys to the kingdom, if you will,” he said.
CVE-2026-116606 and CVE-2026-111560 both impact Barracuda’s Email Security Gateway (ESG), but CVE-2026-111560 also impacts its Web Security Gateway (WSG), Web Application Firewall (WAF), WAF Control Center (WCC), Load Balancer Application Delivery Controller (ADC), and Message Archiver (BMA), the company said.
Customers using these products should verify that their systems are running the latest firmware versions and have received all security patches, it advised. The device will show the latest firmware version available; if a device’s firmware is multiple versions out of date, users may need to perform several updates.
Enterprises whose appliances’ admin interfaces are not publicly accessible from the web are less exposed, Barracuda said; the company advised restricting access to these interfaces to trusted internal networks and applying appropriate network access controls to limit exposure.
“The biggest concern is how these two vulnerabilities could chain together,” said Jon Nelson, principal advisory director at Infotech, noting that an attacker who can bypass authentication and then exploit command injection could move from accessing an exposed appliance to executing commands on it. “Assessing each vulnerability in isolation can understate the risk,” he said.
Dickson added that security leaders should read the advisory closely, as it calls one flaw “pre-authentication,” then lists “Authentication Required: Yes, administrative access.”
“Both cannot be true in the usual sense,” he pointed out. Likely access here means being able to reach the admin interface over the network, without a password.
“If your admin interface faces the internet, that condition is already met,” Dickson said.
The advisory also labels a 9.3 severity rating as “high,” when 9.0 and above is actually “critical” on the standard scale, he pointed out. “These are small things, but labels drive patching queues,” he noted. Also, the advisory does not say whether these flaws are currently being exploited, but it does not say they are not, either.
How enterprises should respond
“Get the admin interface off the internet,” Dickson emphasized, noting that, as a cybersecurity consultant, he gives that advice at least a handful of times a week. “Management interfaces on edge devices are continually a source of vulnerability.”
Once teams limit admin access to a trusted internal network or a dedicated management network, Dickson advised, they should then “verify the patch rather than assume it was properly installed.” From there, he said, analyze for unauthorized visitors by reviewing admin logs, check for unfamiliar accounts, and look for unexpected outbound connections from the device.
History matters here, he added. In 2023, after a zero-day on this same email security gateway (ESG), Barracuda told customers with compromised appliances to replace them outright rather than rely on the patch. As he put it: “A patch fixes the lock. It does not tell you who already has a key.”
Nelson agreed that enterprises should look closely at who can reach their administrative interfaces. They should, in addition, put access behind additional controls such as a properly configured zero trust access layer.
“Exposing those interfaces directly to the internet was always a bad idea,” he said. “As AI makes it easier to find weaknesses and chain attacks together, that exposure becomes increasingly difficult to justify.” AI is also expanding the search for software flaws to include issues such as business logic weaknesses where an application can be made to bypass its intended controls. Authentication and authorization bypasses deserve particular attention in that context, Nelson said.
As more vendors use advanced AI to examine their code, CISOs should prepare for more flaw disclosures and potentially shorter windows to respond to them, he noted. “That means identifying exposed appliances, restricting access, and having a response plan ready before the next zero day arrives,” he said.
Understanding what each appliance exposes
Security appliances are increasingly creating vulnerabilities in corporate networks, which is changing the cybersecurity discussion. Enterprises rely on them to protect the network, yet ultimately they are software systems with vulnerabilities of their own.
“They sit exactly where attackers want to be,” Dickson noted.
Firewalls, VPNs, and email gateways face the internet by design; that is their job, he said. They see sensitive traffic and hold credentials. Most cannot run the endpoint detection tools that protect laptops and servers, so a compromise can remain undetected for a long time, and every customer runs the same firmware, so one working exploit can scale to thousands of organizations.
“The discussion is shifting from which box to buy to what the box itself exposes,” Dickson said. “Every appliance purchase is a decision to trust a vendor’s code at the most exposed point in the network.” It deserves the same scrutiny as any other in an enterprise, he noted.
Buyers should ask their vendors four questions, he advised: Is the admin interface exposed to the internet by default; how quickly do patches ship; are they applied automatically; and what logging can users see?
“The security appliance does not just protect the perimeter,” Dickson pointed out. “It is the perimeter, and it should be treated as the most attacked system an organization owns, because it is.”