Barracuda’s security appliances have a security problem of their own
Summary
Barracuda has disclosed two critical vulnerabilities, CVE-2026-116606 and CVE-2026-111560, that can be chained to allow attackers to bypass authorization and gain root access to their security appliances. These vulnerabilities impact several popular Barracuda products, including the Email Security Gateway, Web Security Gateway, and Web Application Firewall. Barracuda has released security patches and urges customers to apply them immediately.
IFF Assessment
The discovery of critical vulnerabilities in widely used security appliances poses a significant risk to organizations, enabling potential unauthorized access and compromise of sensitive data.
Severity
Defender Context
This incident highlights the critical importance of timely patching for all security infrastructure. Defenders should prioritize verifying that Barracuda ESG, WSG, WAF, WCC, ADC, and BMA devices are updated with the latest firmware and security patches. Monitoring for any signs of unauthorized access or unusual network activity related to these devices is also crucial.