Barracuda Flaws Chain to Root on Edge Devices

Barracuda builds devices meant to guard the network edge, and right now two of its own products are the ones under scrutiny. The company has disclosed a critical authorization bypass and a high-severity command injection flaw that, combined, could let an attacker slip past access controls and land root on the box. Patches exist. The harder question is whether every customer will read the advisory carefully enough to know what they are actually exposed to.

That reading matters because the language in the notice is doing a lot of work, and at least one researcher thinks some of it is muddled in ways that could steer patching decisions. Below is what the two flaws are, which products they touch, and what people who work on edge security say teams should do first.

Two flaws, one chain

The first issue is a pre-authentication authorization bypass tracked as CVE-2026-116606, rated 9.3 on the CVSS scale. The second is a command injection bug tracked as CVE-2026-111560, rated 8.6. Barracuda rates the first critical and the second high severity.

Neither one is a remote walk-up exploit on its own terms. To pull off the attack, the intruder needs access to the admin interface of a susceptible device. That single prerequisite is where most of the practical risk lives, and it is also where the two flaws become more dangerous together than separately.

Which Barracuda products are affected

Both CVEs hit Barracuda's Email Security Gateway (ESG). The command injection flaw, CVE-2026-111560, has a wider footprint and also affects the Web Security Gateway (WSG), the Web Application Firewall (WAF), the WAF Control Center (WCC), the Load Balancer Application Delivery Controller (ADC), and the Message Archiver (BMA).

Barracuda has released security patches for the affected products and advises customers to apply them immediately. It also asks customers to confirm their systems are running the latest firmware and have received all security patches. That check is less trivial than it sounds: the device will display the latest firmware version available, and if a given unit is several versions behind, administrators may need to run multiple updates in sequence to get current.

Enterprises whose appliances do not expose their admin interfaces to the public web are less exposed, according to Barracuda. The company's guidance is to restrict access to those interfaces to trusted internal networks and to apply network access controls that limit who can reach them.

What root on a gateway actually buys

The severity of a root compromise depends heavily on where the compromised device sits, and an email gateway sits in an unusually sensitive spot. Frank Dickson of Dickson Research described what root access on an email gateway hands an attacker: control over the position every inbound and outbound message passes through, along with potential exposure of the credentials and connections the gateway uses to reach the mail server and directory.

“Those are the keys to the kingdom, if you will,” he said.

— Frank Dickson of Dickson Research

That framing is worth pausing on. A mail gateway is not a passive filter; it is a trusted intermediary holding the credentials it needs to deliver and retrieve mail and to talk to directory services. Root on that system is not just root on a box — it is standing inside the trust path between an organization's mail flow and its identity infrastructure.

The advisory language that raises questions

Two researchers who reviewed the disclosure both focused on how it should be read rather than just what it says. Jon Nelson, principal advisory director at Infotech, zeroed in on the interaction between the two flaws.

“The biggest concern is how these two vulnerabilities could chain together,” said Jon Nelson, principal advisory director at Infotech, noting that an attacker who can bypass authentication and then exploit command injection could move from accessing an exposed appliance to executing commands on it. “Assessing each vulnerability in isolation can understate the risk,” he said.

— Jon Nelson, principal advisory director at Infotech

Dickson raised a different concern about the text itself. He said security leaders should read the advisory closely, because it calls one flaw pre-authentication and then lists “Authentication Required: Yes, administrative access.”

“Both cannot be true in the usual sense,” he pointed out.

— Frank Dickson of Dickson Research

His reading is that access in this context likely means the ability to reach the admin interface over the network without a password, rather than a full credential check.

“If your admin interface faces the internet, that condition is already met,” Dickson said.

— Frank Dickson of Dickson Research

He also flagged a labeling discrepancy: the advisory describes the 9.3 severity rating as high, while 9.0 and above is normally considered critical on the standard scale. He noted that the advisory also does not state whether the flaws are currently being exploited, though it does not say they are not being exploited either.

“These are small things, but labels drive patching queues,” he noted.

— Frank Dickson of Dickson Research

The point is not pedantry. A team that triages by severity band may treat a flaw labeled high differently than one labeled critical, and the timing of that decision can matter more than the distinction itself.

Getting the admin interface off the internet

If there is one piece of advice both researchers return to, it is exposure. Dickson's first instruction is blunt.

“Get the admin interface off the internet,” Dickson emphasized, noting that, as a cybersecurity consultant, he gives that advice at least a handful of times a week. “Management interfaces on edge devices are continually a source of vulnerability.”

— Frank Dickson of Dickson Research

Once admin access is limited to a trusted internal network or a dedicated management network, Dickson does not stop at patching. He advises teams to verify that the patch actually took rather than assume it was properly installed. From there, he said, the next steps are to analyze for unauthorized visitors by reviewing admin logs, check for unfamiliar accounts, and look for unexpected outbound connections from the device.

Nelson's recommendations run along the same line. Enterprises should look closely at who can reach their administrative interfaces and put access behind additional controls, such as a properly configured zero trust access layer.

“Exposing those interfaces directly to the internet was always a bad idea,” he said. “As AI makes it easier to find weaknesses and chain attacks together, that exposure becomes increasingly difficult to justify.”

— Jon Nelson, principal advisory director at Infotech

The patch does not tell you who has a key

Dickson brought up history that is directly relevant to this product line. In 2023, after a zero-day on the same email security gateway, Barracuda told customers with compromised appliances to replace them outright rather than rely on the patch. That precedent shapes how he thinks about verification now.

“A patch fixes the lock. It does not tell you who already has a key.”

— Frank Dickson of Dickson Research

For teams running the affected Barracuda gear, that is the difference between closing the door and confirming nobody came through it. Patching addresses the flaw. Log review, account audits, and outbound connection checks address the possibility that someone already used it.

Why security appliances keep showing up in these stories

Dickson's broader observation is that security appliances are increasingly a source of vulnerabilities in corporate networks, and that this is changing the conversation around them. Enterprises lean on these devices to protect the network, yet they are software systems with their own flaws.

“They sit exactly where attackers want to be,” Dickson noted.

— Frank Dickson of Dickson Research

Firewalls, VPNs, and email gateways face the internet by design because that is their job, he said. They see sensitive traffic and hold credentials. Most cannot run the endpoint detection tools that protect laptops and servers, so a compromise can remain undetected for a long time. And because every customer runs the same firmware, one working exploit can scale to thousands of organizations.

“The discussion is shifting from which box to buy to what the box itself exposes,” Dickson said. “Every appliance purchase is a decision to trust a vendor’s code at the most exposed point in the network.”

— Frank Dickson of Dickson Research

That shift has practical consequences for procurement. Dickson advises buyers to put four questions to their vendors: whether the admin interface is exposed to the internet by default, how quickly patches ship, whether they are applied automatically, and what logging users can see.

“The security appliance does not just protect the perimeter,” Dickson pointed out. “It is the perimeter, and it should be treated as the most attacked system an organization owns, because it is.”

— Frank Dickson of Dickson Research

The numbers behind the response

The disclosure carries a handful of figures that matter for prioritization:

• CVE-2026-116606 is a pre-authentication authorization bypass rated 9.3 on CVSS.
• CVE-2026-111560 is a command injection flaw rated 8.6 on CVSS.
• The command injection flaw affects six product lines: ESG, WSG, WAF, WCC, ADC, and BMA.
• A device that is multiple firmware versions behind may require several sequential updates to reach the current release.
• The 2023 zero-day on the same email security gateway led Barracuda to tell customers with compromised appliances to replace them rather than rely on the patch.

AI changes the timeline, not just the tooling

Nelson tied the disclosure to AI in two directions. On offense, he said AI is making it easier to find weaknesses and chain attacks together, which is part of why he argues internet-facing admin interfaces are increasingly hard to justify. AI is also widening the search for software flaws to include issues like business logic weaknesses, where an application can be made to bypass its intended controls. Authentication and authorization bypasses deserve particular attention in that context, he said.

On defense, he noted that as more vendors use advanced AI to examine their code, CISOs should prepare for more flaw disclosures and potentially shorter windows to respond to them.

“That means identifying exposed appliances, restricting access, and having a response plan ready before the next zero day arrives,” he said.

— Jon Nelson, principal advisory director at Infotech

What this means for teams running the affected gear

The immediate to-do list is narrow: patch the affected Barracuda products, confirm the firmware is actually current rather than assuming a single update closed the gap, and pull admin interfaces behind trusted internal or management networks. Barracuda's own guidance points the same direction, restricting admin access to trusted networks and applying network access controls to limit exposure.

The less comfortable part of the list is the checking. Dickson's advice to verify the patch rather than assume it, review admin logs for unauthorized visitors, look for unfamiliar accounts, and inspect outbound connections from the device reflects a reality the 2023 episode made plain: remediation and confirmation are two different jobs. Teams that only do the first may be left with a closed lock and no idea who already had a key.

For security leaders more broadly, the disclosure is a reminder that the appliance protecting the perimeter is itself a system that must be inventoried, patched, and monitored like any other. Nelson's guidance that organizations identify exposed appliances, restrict access, and have a response plan ready before the next zero day is, in effect, a description of what an updated asset and access inventory would look like in practice. The vendors are not the only ones whose code decisions matter here — every purchase of an edge device is a decision to trust that vendor's code at the most exposed point in the network, as Dickson put it, and that decision deserves the same scrutiny as anything else in the enterprise.