Barracuda sells security appliances to keep attackers out, and now one of its own product lines is the entry point. The company has disclosed two vulnerabilities, rated critical and high severity, that could be chained to bypass authorization and gain root access on affected devices. The attacker still needs to reach the admin interface first, and that requirement makes network exposure the central question.
What the two flaws do
The first is a pre-authentication authorization bypass, tracked as CVE-2026-116606. It carries a CVSS score of 9.3, which puts it in the critical band. The second is a command injection flaw, CVE-2026-111560, rated 8.6 and high severity. Neither flaw is exploitable in isolation without reaching the admin interface, but together they form a path from network access to code execution.
Barracuda has released patches and tells customers to apply them immediately. That's the easy part. The harder work is figuring out which devices are exposed and whether they were already touched before the fix landed.
Which Barracuda products are affected
Both vulnerabilities affect the Email Security Gateway (ESG). CVE-2026-111560 reaches further, extending to the Web Security Gateway (WSG), Web Application Firewall (WAF), WAF Control Center (WCC), Load Balancer Application Delivery Controller (ADC), and Message Archiver (BMA), according to the company.
Barracuda's guidance is to confirm that each device runs the latest firmware and has every security patch applied. The device's management interface will display the newest available firmware version. If a unit is several versions behind, administrators may need to step through multiple updates rather than jump straight to the current release. Don't assume a single update closes the gap.
Organizations whose appliance admin interfaces aren't reachable from the public web face less risk, Barracuda said. The company recommends restricting those interfaces to trusted internal networks and applying network access controls to limit who can reach them.
The advisory's internal contradictions
Frank Dickson of Dickson Research read the advisory closely and flagged a problem with its wording. The document calls one flaw "pre-authentication," then lists "Authentication Required: Yes, administrative access." Both can't be true in the usual sense. Dickson's read is that the intended meaning is reachability: an attacker who can get to the admin interface over the network doesn't need a password.
His second point concerns severity labeling. The advisory describes a 9.3 score as "high," while the standard scale treats 9.0 and above as critical. "These are small things, but labels drive patching queues," he said. Teams that sort work by label rather than score could push the most urgent fix down the list.
The advisory also doesn't say whether these flaws are being exploited in the wild. It doesn't rule it out either, which is a reason to assume attackers may already be probing.
Why root on a gateway hurts more
Dickson put the stakes in concrete terms. Root access on an email gateway places an attacker where every inbound and outbound message passes. It may also expose the credentials and connections the gateway uses to reach mail servers and directory services. "Those are the keys to the kingdom, if you will," he said.
Jon Nelson, principal advisory director at Infotech, focused on the chaining risk. An attacker who bypasses authentication and then exploits command injection can move from reaching an exposed appliance to running commands on it. "Assessing each vulnerability in isolation can understate the risk," he said. Scoring the two flaws separately misses the sequence that makes them dangerous together.
What security teams should do first
Dickson's first instruction is blunt: get the admin interface off the internet. He says he gives that advice at least a handful of times a week, and that management interfaces on edge devices keep showing up as a recurring source of weakness.
Once admin access sits on a trusted internal or dedicated management network, the next step is verification. Dickson advised teams to "verify the patch rather than assume it was properly installed." From there, he recommended reviewing admin logs for unauthorized access, checking for unfamiliar accounts, and looking for unexpected outbound connections from the device.
History adds weight to that advice. In 2023, after a zero-day in the same Email Security Gateway, Barracuda told customers with compromised appliances to replace them rather than rely on the patch. Dickson's summary of the lesson: "A patch fixes the lock. It does not tell you who already has a key."
Nelson agreed that teams need to review who can reach administrative interfaces. He also recommended putting that access behind additional controls, such as a properly configured zero trust access layer, so that a reachable login page isn't the only barrier.
Nelson also tied the problem to how bugs are now found. "Exposing those interfaces directly to the internet was always a bad idea," he said. "As AI makes it easier to find weaknesses and chain attacks together, that exposure becomes increasingly difficult to justify." He noted that automated analysis is widening the search for flaws beyond memory-safety bugs, into business logic weaknesses where an application can be pushed past its intended controls. Authentication and authorization bypasses are a particular concern in that setting.
Nelson expects more vendors to use advanced AI tools on their own code, which could mean more disclosures and shorter windows to respond. "That means identifying exposed appliances, restricting access, and having a response plan ready before the next zero day arrives," he said.
The appliance is the new attack surface
Security appliances are a growing source of risk inside corporate networks, and that's shifting how buyers should think about them. Enterprises deploy these boxes to protect the network, but they're software systems with their own vulnerabilities. "They sit exactly where attackers want to be," Dickson said.
Firewalls, VPN concentrators, and email gateways face the internet by design. They see sensitive traffic and hold credentials. Most can't run the endpoint detection tools that protect laptops and servers, so a compromise can persist unnoticed for a long time. And because every customer runs the same firmware, a single working exploit can scale across thousands of organizations.
"The discussion is shifting from which box to buy to what the box itself exposes," Dickson said. "Every appliance purchase is a decision to trust a vendor's code at the most exposed point in the network." He argues that this decision deserves the same scrutiny as any other in an enterprise.
For procurement, he suggests asking vendors four questions. Is the admin interface exposed to the internet by default? How quickly do patches ship? Are they applied automatically? And what logging can customers see? Those answers will tell a buyer more about operational risk than a feature list.
Dickson's closing point is the one to take back to the security team. "The security appliance does not just protect the perimeter," he said. "It is the perimeter, and it should be treated as the most attacked system an organization owns, because it is."
