Affected Systems

Barracuda Email Security Gateway (CVE-2026-116606, CVSS 9.3) and multiple products including Email Security Gateway, Load Balancer, Application Delivery Controller, Message Archiver, WAF Control Center, Web Application Firewall, Web Security Gateway (CVE-2026-111560, CVSS 8.6). Exploitation requires access to administrative interface.

Exploitation Status

No evidence of active exploitation reported. Vendor disclosure suggests theoretical attack path. Organizations not exposing admin interfaces to internet are less vulnerable.

Business Impact

Chaining these vulnerabilities allows unauthenticated attackers with access to admin interfaces to bypass authorization and gain root access to affected Barracuda devices. Risk is significantly elevated for organizations exposing administrative interfaces to the internet. Devices with outdated firmware may require multiple sequential updates to remediate.

Urgency

🟠 Within 24 hours

Recommended Actions

  • Immediately verify all Barracuda Email Security Gateway, Load Balancer, Application Delivery Controller, Message Archiver, WAF Control Center, Web Application Firewall, and Web Security Gateway devices are running latest firmware with security patches applied
  • Restrict administrative interface access to trusted internal networks only; remove any internet-facing exposure to admin panels
  • Implement network access controls (firewall rules, VLANs, jump hosts) to limit admin interface reachability to authorized management networks
  • Review access logs for administrative interfaces for unauthorized access attempts or anomalous authentication patterns prior to patching
  • For devices multiple versions behind, plan staged firmware updates following Barracuda's upgrade path documentation