BleepingComputer reported on 3 November 2026 that Barracuda Networks has warned customers to patch two vulnerabilities that can let attackers run commands with root privileges. CVE-2026-116606 is an Email Security Gateway (ESG) authentication weakness that attackers can exploit to modify an appliance's global configuration, and CVE-2026-111560 lets attackers with admin permissions inject operating-system commands that run as root.

BleepingComputer quotes Barracuda: "Successful exploitation requires an attacker to have access to the administrative interface of an affected product. If exploited in combination, these vulnerabilities could allow an attacker to bypass authorization controls and obtain root access to the device." Barracuda advises customers to restrict administrative interfaces to trusted internal networks.

Per the table BleepingComputer published from Barracuda's advisory, ESG is affected by both flaws (patches BNSF-40425 for 9.4.017 and later, BNSF-40430 for earlier versions), and Load Balancer ADC (BNADC-16586), Message Archiver (BNMA-32468), WAF Control Center (BNWF-60060), Web Application Firewall (BNADC-16586) and Web Security Gateway (BNYF-24789) by CVE-2026-111560 only.

Neither BleepingComputer nor the quoted advisory says the flaws are being exploited. (source: BleepingComputer)