Barracuda warns customers to patch two flaws enabling root command execution
BleepingComputer reports that Barracuda Networks warned customers to patch two vulnerabilities. The item says the flaws can let attackers run commands with root privileges.
Written by a model from the sources below. Verify against them.
- Kind
- Vulnerability
- Vendor
- Barracuda
- Product
- Web Security Gateway, WAF Control Center, Web Application Firewall
- Status
- Confirmed
- First seen
- Confirmed
What to do
Apply Barracuda's patches to affected devices now.
Check Barracuda's advisory to confirm which products and versions are affected.
Review device logs for unexpected commands or root-level changes.
Restrict administrative access to affected devices until they are patched.
Apply Barracuda's vendor-issued patches to affected devices immediately
Restrict management interface access to trusted networks
Timeline
- Made public by Mastodon
- First seen by cve.now1 day
- Record last updated
- Confirmed as CVE-2026-116606
On X 6
Venkata Satish Guttula 🛰️@snakeyesV1Cybersecurity review | 3 November 2026 1. cPGuard update breach OPSSHIELD says stolen credentials let an attacker push a backdoor through updates on Nov 2. Versions 5.88.12–5.88.19 are affected. Update to 5.88.25 or later, check update logs and rotate exposed credentials. The attacker retrieved some stolen data; the full scope is still under review. opsshield.com/notice/cpguard… 2. Barracuda patches The Nov 2 advisory covers an access-control bypass and command injection. On ESG, the flaws can be chained to gain root access if an attacker can reach the admin interface. Check firmware and patches, and restrict admin access. The advisory does not report active attacks. trust.barracuda.com/security/pre-a… 3. Linux kernel fixes For CVE-2026-98432, Ubuntu lists 26.10 as fixed. Fixes for 22.04, 24.04 and 26.04 LTS remain in -proposed testing. Disabling MPTCP is not a complete fix. Ubuntu describes an unreleased research exploit; its update does not confirm active attacks. ubuntu.com/blog/fixes-ava…
FalconFeeds.io@FalconFeedsio📢 Ransomware Alert: 🇹🇷 Evinoks (evinoks.com), a Turkey-based Furniture company, has reportedly fallen victim to BARRACUDA ransomware. 🔍 Key Details: 🛡️ Threat Actor: BARRACUDA 📅 Reported on: 01/11/26 ⚠️ Data Compromised: 1.56 TB
Ransom-DB@Ransom_DB🔥 Daily Ransomware Digest - Total 22 Victims Top Groups: Qilin - 11 victims Interlock - 2 victims Vexy - 2 victims Barracuda - 1 victim DireWolf - 1 victim Doommageddon - 1 victim Emperador - 1 victim Hyflock - 1 victim Shiba - 1 victim WhiteArmor - 1 victim Top Attacked Countries: 🇺🇸 United States (9) 🇩🇪 Germany (4) 🇹🇷 Turkey (2) Top Attacked Industries: 💻 IT services 🏥 Healthcare 🏬 Retail real estate Qilin led the day with 11 victims, while Interlock and Vexy followed with two claims each. Seven other threat actors each struck once, rounding out a fragmented tail. Activity clustered heavily in the United States with nine recorded incidents, followed by Germany with four. Sector impact remained dispersed, showing slight concentration in IT services and healthcare. Notable targets included Community Medical Center, a U.S. healthcare facility, and the municipal administration of Falls City, Nebraska, both claimed by Qilin.
Show 3 more posts
Ransom-DB@Ransom_DB🔥 Daily Ransomware Digest - Total 22 Victims Top Groups: Play News - 5 victims WhiteArmor - 4 victims Akira - 3 victims Rhysida - 3 victims Aur0ra - 2 victims Payload - 2 victims Barracuda - 1 victim BYOD - 1 victim Emperador - 1 victim Top Attacked Countries: 🇺🇸 United States (10) 🇧🇪 Belgium (2) 🇩🇪 Germany (2) Top Attacked Industries: 🪙 Cryptocurrency exchange 💼 Financial services 🔬 Diagnostics Play News led the day with 5 victims, followed by WhiteArmor with 4, while Akira and Rhysida each struck 3 times. Activity clustered heavily in the United States, which absorbed 10 attacks. Notably, WhiteArmor listed Kucoin, a major international cryptocurrency exchange, highlighting threat actor focus on the digital asset sector alongside traditional financial and commercial services.
FalconFeeds.io@FalconFeedsio📢 Ransomware Alert 🇩🇰 Femern Link Contractors (femernlinkcontractors.com), a Denmark-based building and construction company, has reportedly fallen victim to BARRACUDA ransomware. 🔍 Key Details: 🛡️ Threat Actor: BARRACUDA 📅 Reported on: 28/10/26
DarkWebSonar.io@darkwebsonar🇩🇰 We tracked a ransomware claim by Barracuda listing Femern Link Contractors, the joint venture building the Fehmarnbelt tunnel between Denmark and Germany. Barracuda claims to have exfiltrated 2.44 TB including contracts, bank details and employee data. We've logged 3 Barracuda listings in the past 30 days. #Ransomware #Manufacturing #ThreatIntel Details + live feed → go.darkwebsonar.io/barracuda-x
Evidence 5
- SocialMastodon
“An authentication bypass in Barracuda Email Security Gateway versions earlier than 9.4.0.030 allows an unauthenticated remote attacker to invoke a configuration-import function and restore a crafted, compatible bac...”
- SocialMastodon
“Improper neutralization of shell metacharacters in the timezone configuration field in certain Barracuda appliance products usin...”
- SocialMastodon
“Patch two Barracuda vulnerabilities, CVE-2026-116606 and CVE-2026-111560, that allow attackers to gain Barracuda root access across multiple appliances.”
- PressBleepingComputer
“Cybersecurity company Barracuda Networks warned customers to patch two vulnerabilities that can let attackers run commands with root privileges.”
+1 more: BleepingComputer on Bluesky - PressThe Hacker News
“Barracuda has disclosed details of two vulnerabilities affecting its products that, if chained together, could allow an attacker to bypass authorization controls and gain root access to a susceptible device.”
Corrections
None so far.
Something wrong on this page? Report an error. Every fix is listed here.
Questions about SZB-1ac4bc8960
Has Barracuda confirmed it?
Yes. Confirmed as CVE-2026-116606.Source: Mastodon, Mastodon, Mastodon, BleepingComputer, The Hacker News
What should Barracuda users do?
Apply Barracuda's patches to affected devices now. Check Barracuda's advisory to confirm which products and versions are affected. Review device logs for unexpected commands or root-level changes. Restrict administrative access to affected devices until they are patched. Apply Barracuda's vendor-issued patches to affected devices immediately. Restrict management interface access to trusted networks.
Does it have a CVE?
Yes. It is tracked as CVE-2026-116606.Source: CVE-2026-116606