Barracuda says two flaws could give hackers full control of devices

Barracuda Networks is telling customers to install updates for two security flaws that could give an attacker full control of a device. In this case, full control means "root" access, the highest level of permission on a system.

What changed

The first flaw, CVE-2026-116606, is rated critical. It is a weakness in how Barracuda's Email Security Gateway checks who is allowed in, and it lets an attacker change the device's global settings. The second, CVE-2026-111560, lets someone who already has admin permissions slip in commands that run as root. Barracuda says that used together, the two could let an attacker get around permission checks and take over the device.

Who can relax, and who should not

Barracuda says an attacker must be able to reach the device's administrative interface, which is the control page used to manage it. Companies that limit that page to trusted internal networks lower their risk. Those that leave it reachable from the wider internet should move faster. Barracuda has more than 200,000 customers, from small and midsize businesses to large enterprises and managed service providers, which are firms that run IT for other companies.

Barracuda's email security devices have been a target before. In 2023, hackers abused flaws in them in spy attacks. One was exploited for at least seven months, and Mandiant found that almost a third of the hacked appliances belonged to government agencies.

What is not known yet

The report does not say whether attackers are already using these new flaws. It also leaves the full list of affected products to a table from Barracuda, so check that table instead of assuming your device is safe. The steps in the alert box above cover what to do next.