GoKawiilBarracuda patches two root-access flaws across multiple security appliances
Barracuda Networks has released patches for two vulnerabilities, CVE-2026-116606 and CVE-2026-111560, affecting its Email Security Gateway and several other products including its Load Balancer ADC, Message Archiver, WAF Control Center, Web Application Firewall, and Web Security Gateway. Chained together, the flaws could let an attacker with access to a device's administrative interface bypass authorization controls and gain root access.
GoKawiil's interpretation of the reporting above, not reported fact.
Barracuda notes exploitation requires prior access to an admin interface, which limits the immediate risk but still leaves exposed devices vulnerable if network controls are weak. The company's history with Email Security Gateway flaws, including a 2023 zero-day exploited by the UNC4841 hacking group, suggests these appliances remain an attractive target for sophisticated attackers.
- Barracuda patched two vulnerabilities that can be chained for root-level device access.
- Affected products include ESG, Load Balancer ADC, Message Archiver, WAF Control Center, WAF, and WSG.
- Barracuda urges customers to restrict admin interface access and apply the latest firmware patches.
YubiKey 5 Series Security Key — Hardening admin access is exactly what this Barracuda situation calls for, and a hardware security key like YubiKey adds strong phishing-resistant authentication to admin logins and VPNs. It's a simple, durable way to reduce the risk of unauthorized access to sensitive management interfaces mentioned in the article.
See YubiKey 5 Series Security Key on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: bleepingcomputer.com, 2026-11-03
Published there as: “Barracuda warns of critical flaws allowing root access to devices”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.