"Successful exploitation requires an attacker to have access to the administrative interface of an affected product," Barracuda warned — a short, plain sentence that underlines how two newly disclosed vulnerabilities could let an intruder gain complete control over affected appliances if administrative access is available.
CVE-2026-116606 and CVE-2026-111560: what each flaw permits
Barracuda Networks identified two distinct vulnerabilities that customers must patch. CVE-2026-116606 is a critical flaw tied to an Email Security Gateway (ESG) authentication weakness; Barracuda says attackers can exploit it to modify an appliance’s global configuration. CVE-2026-111560 is different in scope: it allows threat actors who already have administrative permissions to inject operating-system commands that then execute with root privileges. Taken together — Barracuda noted — the two could be combined to bypass authorization controls and obtain root access to the device.
Barracuda's remediation steps and customer guidance
In response to the findings, Barracuda “immediately initiated a comprehensive remediation process and released security patches for affected products,” the company reported. Customers were advised to review the affected products and remediation guidance that Barracuda published, to ensure their systems are running the latest firmware version, and to have all security patches applied. The company also provided a complete list of affected devices and available security patches in a table accompanying its advisory.
The cyber insurance questionnaire just landed. Now what?
SOC 2, HIPAA, insurance renewals - someone has to own security strategy. Nubivance provides fractional CISO leadership without the full-time salary.
Get a security leadAdministrative interface access, network controls, and limiting exposure
Barracuda emphasized that successful exploitation also requires access to the administrative interfaces of targeted devices. To reduce attack surface, the vendor advised customers to use appropriate network access controls and to restrict administrative-interface access to trusted internal networks. That constraint — access to a management interface — is central to the vendor’s assessment of risk: with administrative access, an attacker can move from configuration changes to full root command execution if both vulnerabilities are chained.
Related incidents: UNC4841, CVE-2023-7102 and CVE-2023-2868
The advisory echoes events from three years ago when Barracuda patched an ESG flaw tracked as CVE-2023-7102 that the UNC4841 hacking group exploited in zero-day attacks to execute arbitrary code on unpatched appliances. In the same year, UNC4841 also abused another zero-day, CVE-2023-2868, to target Barracuda ESG appliances as part of cyber-espionage operations. Barracuda later disclosed that the vulnerability had been exploited for at least seven months — since at least October 2022 — to deploy previously unknown SeaSpy and Saltwater malware and to steal data from compromised systems. Cybersecurity firm Mandiant reported that almost a third of appliances hacked in that 2023 campaign belonged to government agencies worldwide, with most breaches occurring between October and December 2022.
What this means for SMBs, large enterprises, and managed service providers (MSPs)
- SMBs: Barracuda noted it serves more than 200,000 customers, including small- to medium-sized businesses; those organizations should ensure firmware and patches are current and restrict who can reach administrative interfaces to trusted networks.
- Large enterprises: given the possibility of configuration modification and root command execution, enterprises should inventory ESG appliances, confirm firmware levels, and apply Barracuda’s patches across their estates to close the authorization and OS-command injection paths.
- MSPs: managed service providers that use Barracuda appliances on behalf of customers should verify multi-tenant and administrative access controls, install the vendor patches promptly, and review access policies to reduce exposure to administrative-interface compromise.
Barracuda has made patches available and published guidance; the vendor’s prior disclosures and the history of UNC4841 exploitation underscore the practical stakes for organizations running affected Email Security Gateway appliances. Customers are left with concrete steps issued by the vendor — review the affected-product table, install the updates, and tighten administrative access — and a reminder that unpatched management interfaces remain a high-value target.
