Security Updates Available for Certain Barracuda Products
Barracuda Networks has identified two vulnerabilities affecting certain Barracuda Networks products: a pre-authentication authorization bypass vulnerability, CVE-2026-116606, and a command injection vulnerability, CVE-2026-111560.
Successful exploitation requires an attacker to have access to the administrative interface of an affected product. If exploited in combination, these vulnerabilities could allow an attacker to bypass authorization controls and obtain root access to the device.
Barracuda Networks has released security patches for affected products. Customers should review the affected products and remediation guidance in the Trust Center security advisory, ensure their systems are running the latest firmware version, and confirm that all applicable security patches have been applied.
Product-specific instructions for manually applying patches or updating firmware are provided below. If you need assistance verifying your firmware version or applying the appropriate security patch, please contact Barracuda Networks Technical Support at support@barracuda.com.
Barracuda Networks strongly recommends keeping all products on the latest available firmware version.
Affected Product | Campus Article Instructions |
|---|---|
Email Security Gateway (ESG) | |
Load Balancer Application Delivery Controller (ADC) | Command Injection Vulnerability in Barracuda Application Delivery Controller |
Message Archiver (BMA) | Command Injection Vulnerability in Barracuda Message Archiver |
WAF Control Center (WCC) | Command Injection Vulnerability in Barracuda WAF Control Center |
Web Application Firewall (WAF) | Command Injection Vulnerability in Barracuda Web Application Firewall |
Web Security Gateway (WSG) | Command Injection Vulnerability in Barracuda Web Security Gateway |