Barracuda discloses critical command injection CVEs across multiple products

Key points

• Two critical Barracuda CVEs are tracked as CVE-2026-116606 and CVE-2026-111560.
• Affected systems include ADC, Message Archiver, Email Security Gateway, WAF Control Center, Load Balancer, Web Security Gateway, and Web Application Firewall.
• The flaw class is OS command injection leading to root-level execution after authenticated admin access.
• Vendor guidance calls for mitigations, patching, and retirement where supported fixes are unavailable.

Barracuda Networks has published remediation details for two critical vulnerabilities, tracked as CVE-2026-116606 and CVE-2026-111560. The issues involve operating-system command injection that can result in commands running with root-level authority. Exploitation is tied to authenticated administrator access, so the exposure is not limited to anonymous internet users but still matters greatly wherever privileged appliance accounts are weakly controlled or shared.

The vendor’s notice covers a broad set of systems: ADC, Message Archiver, Email Security Gateway, WAF Control Center, Load Balancer, Web Security Gateway, and Web Application Firewall. Because these products sit at chokepoints for mail flow, traffic inspection, application delivery, and archiving, a compromised device can affect more than the appliance itself. For a K-12 environment, that could mean disruption to district communications, web services, or network segmentation if any of these platforms are in service.

The practical response is to treat vendor instructions as mandatory. Administrators should deploy available fixes according to Barracuda’s guidance, apply interim mitigations where patching cannot happen immediately, and stop relying on any affected product that has no supported remediation path. Priority should go to internet-facing and highly privileged deployments, followed by internal systems that store or filter sensitive data.

Context matters: command injection flaws on security appliances are especially dangerous because those devices often hold credentials, inspect traffic, and are trusted by other infrastructure. An attacker with admin access could turn a management weakness into root execution and then pivot. Even if no exploitation is confirmed locally, the combination of critical severity and multi-product scope warrants immediate inventory and validation.

What to watch: vendor advisory updates, patch availability for each model and firmware branch, and signs of unexpected command execution or unusual administrative logins. Teams should also track whether any unsupported appliances remain in production, because those require isolation and a retirement plan rather than indefinite deferral.

What to do now

1. Inventory every Barracuda Networks appliance and map each to CVE-2026-116606 or CVE-2026-111560 using vendor advisories.
2. Apply vendor patches first to internet-facing Email Security Gateway, Web Security Gateway, Web Application Firewall, and WAF Control Center deployments.
3. If a patch is not yet available, implement the published mitigations exactly and restrict administrative interfaces to trusted management networks.
4. Review logs for suspicious command execution or anomalous admin activity on affected systems, especially around Load Balancer, ADC, and Message Archiver.
5. Enforce MFA and least privilege for administrative accounts, and rotate credentials for any account with access to affected appliances.
6. For products without a supported remediation path, isolate them immediately and plan retirement or replacement.
7. Validate fixes after patching, document exceptions for leadership, and monitor vendor advisories for updated guidance.

CVE references

• CVE-2026-116606

Original source

CISA Known Exploited Vulnerabilities