Barracuda has disclosed two flaws that an authenticated admin can chain into root on the appliances it sells as security infrastructure. The pair affects Email Security Gateway, Web Security Gateway, the Web Application Firewall, WAF Control Center, Load Balancer ADC, and Message Archiver.
The first is a pre-authentication authorization bypass rated 9.3 and tracked as CVE-2026-116606. The second, CVE-2026-111560, is a command injection rated 8.6 and hits every product on the list. Exploitation requires reaching the admin interface, so appliances with management consoles exposed to the open internet carry the most risk.
Frank Dickson of Dickson Research pointed out what root on a mail gateway buys an attacker: a position on every inbound and outbound message, plus the credentials and connections the gateway uses to reach the mail server and directory.
The vendor’s fix is a firmware update. Barracuda cautions that devices several versions behind may need to install multiple releases in sequence, so check the reported build number rather than assuming the update button finished the job.
Email gateways sit in the one place where mail, directory credentials, and outbound traffic converge, so a root shell there is a foothold rather than a single appliance compromise. Treat the box as a credential store, not just a filter.
Two hardening steps matter as much as patching. Restrict admin interfaces to trusted internal networks, and audit the stored credentials the gateway uses, since anyone who exploited the chain before the fix had the keys to reset them.
