FHN 
Two security vulnerabilities affecting Barracuda products could be chained to bypass authorization controls and obtain root access to vulnerable devices. Barracuda disclosed the flaws on November 2, 2026, and released security patches for affected products.
The vulnerabilities, tracked as CVE-2026-116606 and CVE-2026-111560, involve an authorization bypass and command injection. They carry CVSS scores of 9.3 and 8.6, respectively.
Two Vulnerabilities Identified
The first vulnerability, CVE-2026-116606, affects Barracuda Email Security Gateway (ESG). It involves a pre-authentication authorization bypass that could allow attackers to circumvent security restrictions.
The second flaw, CVE-2026-111560, is a command injection vulnerability affecting multiple Barracuda products, including:
- Email Security Gateway
- Load Balancer Application Delivery Controller
- Message Archiver
- Web Application Firewall
- WAF Control Center
- Web Security Gateway
When exploited together, the vulnerabilities could allow attackers to bypass authorization controls and obtain root access to affected devices.
Administrative Interface Access Required
Barracuda clarified that successful exploitation requires attackers to have access to the administrative interface of an affected product.
Therefore, devices whose administrative interfaces are not exposed to the internet are less vulnerable to this particular attack path.
The company recommends restricting administrative access to trusted internal networks and implementing appropriate network access controls.
Barracuda Releases Security Patches
Barracuda has released firmware updates addressing both vulnerabilities. Customers are advised to verify their installed firmware versions and ensure that all applicable security patches have been applied.
Organizations running outdated firmware may need to perform multiple updates before reaching the latest supported version. Barracuda also recommends enabling automatic patching where possible.
About the Author
