Command Injection Vulnerability in Certain Barracuda Networks Products
Overview
Barracuda Networks has identified a vulnerability affecting certain Barracuda Networks products: a command injection vulnerability assigned CVE-2026-111560.
Successful exploitation requires an attacker to have access to the administrative interface of an affected product. If exploited, this vulnerability could allow an attacker to bypass authorization controls and obtain root access to the device.
Barracuda Networks immediately initiated a comprehensive remediation process and released security patches for affected products. Customers should review the affected products and remediation guidance below, ensure their systems are running the latest firmware version, and have all security patches applied.
Affected versions of Barracuda Message Archiver
Firmware versions 5.2 through 5.5.4.001.
Has Barracuda Networks released a patch?
Yes. Barracuda Networks released firmware version 5.5.4.002, which includes the patch. For appliances running firmware 5.5.0 through 5.5.4.001, a security patch applies automatically and fixes the vulnerability but does not upgrade the firmware. Appliances running firmware 5.2 through 5.4.x must be upgraded manually to firmware version 5.5.4.002.
Action required
Appliances running 5.5.0 through 5.5.4.001 automatically receive a security patch that fixes the vulnerability. The patch does not change the firmware version.
Appliances running 5.2 through 5.4.x must be upgraded manually to firmware 5.5.4.002.
Log in to the BMA web interface as an administrator.
Go to Advanced > Firmware Update.
Check the Current Installed Version.
5.5.0 through 5.5.4.001 – The security patch fixes the vulnerability. No firmware upgrade is required.
5.2 through 5.4.x – Continue with step 4 to upgrade manually.
Click Download Now to download firmware version 5.5.4.002. Click Refresh to check the download status. Do not turn off the appliance during this process.
When the Firmware downloaded message appears and Refresh changes to Apply Now, click Apply Now.
Click OK when prompted to reboot the appliance. A Status page shows the reboot progress, and the login page appears when the reboot is complete.
After the appliance is back online, return to Advanced > Firmware Update and confirm the installed version is 5.5.4.002 or later.
How do I confirm whether my appliance has received the security patch?
Log in to the BMA web interface.
Go to Advanced > Firmware Update.
Check the Current Installed Version.
Compare the Current Installed Version with the following:
5.5.4.002 or later – The appliance has the security patch.
5.5.0 through 5.5.4.001 – The security patch applies automatically and fixes the vulnerability. No action is required.
5.2 through 5.4.x – Follow the steps in Action required to upgrade the appliance to firmware 5.5.4.002, then repeat this confirmation process after the appliance restarts.
Additional resources
Contact Barracuda Networks Technical Support for any additional questions.