By 
The cybersecurity landscape is once more under scrutiny as Barracuda Networks has unveiled two critical vulnerabilities in its systems that could allow attackers to gain root access. This notice comes as part of the company’s ongoing commitment to securing its customers against potential threats, highlighting the importance of timely action in safeguarding sensitive infrastructure.
The vulnerabilities in question are designated as CVE-2026-116606 and CVE-2026-111560. The first vulnerability relates to a weakness in the authentication processes of the Email Security Gateway (ESG) appliance. Attackers could exploit this flaw to make unauthorized modifications to the device's global configuration, thereby compromising its integrity. The second vulnerability allows those with administrative privileges to inject operating system commands which, when executed, also have root-level permissions. This combination poses a significant threat to device security if not addressed promptly.
However, it’s crucial to note that successful exploitation of these vulnerabilities requires an attacker to gain access to the administrative interfaces of the concerned devices. To mitigate these risks, Barracuda has stressed the need for customers to implement stringent network access controls and limit access to trusted internal networks. According to a company statement, "Successful exploitation requires an attacker to have access to the administrative interface of an affected product. If exploited in combination, these vulnerabilities could allow an attacker to bypass authorization controls and obtain root access to the device."
In response to these vulnerabilities, Barracuda swiftly initiated a comprehensive remediation process and rolled out security patches for the affected products. The company has urged customers to review the list of impacted devices and apply necessary patches to ensure their systems are secure. Customers are advised to confirm that their systems are running the latest firmware version and have all available security updates installed to reduce the risk of exploitation.
These recent vulnerabilities aren't the first security challenges faced by Barracuda. In 2023, the company dealt with a similar incident when a critical flaw (CVE-2023-7102) in the Email Security Gateway was exploited by the hacking group UNC4841. This group was involved in zero-day attacks that allowed for arbitrary code execution on unpatched devices. At that time, it had been identified that another zero-day vulnerability, CVE-2023-2868, was also leveraged to target Barracuda ESG appliances in cyber-espionage efforts.
The implications of these previous attacks were significant, leading to the deployment of new and sophisticated malware variants like SeaSpy and Saltwater, which resulted in data breaches and theft from compromised systems. Reports from Mandiant indicated that nearly a third of the hacked appliances during 2023 belonged to government agencies globally, with many breaches occurring between October and December 2022.
Barracuda Networks, founded in 2003, has established itself as a prominent player in the cybersecurity field. The firm caters to over 200,000 customers, ranging from small and medium-sized businesses (SMBs) to large enterprises, including managed service providers (MSPs). This wide range of clientele underscores the importance of their security measures, particularly in light of recent vulnerabilities that have the potential to affect numerous organisations worldwide.
With the ongoing evolution of cyber threats, it is essential for organisations using Barracuda’s security appliances to remain vigilant. Ensuring that all security updates are applied promptly and maintaining robust internal access controls can help shield systems from malicious actors looking to exploit vulnerabilities and gain unauthorised access. This proactive approach is not merely advisable; it is crucial to safeguard sensitive information and maintain the trust of customers and stakeholders alike.
Source: bleepingcomputer.com
