Barracuda Vulnerabilities Could Be Chained to Bypass Authorization and Gain Root Access - Cybersecurity

Barracuda has disclosed two vulnerabilities that could be exploited together to bypass authorization controls and obtain root access on affected devices. The company advises customers to restrict access to administrative interfaces and install the latest firmware and security patches.

Barracuda has disclosed two vulnerabilities affecting its products that could be chained to bypass authorization controls and gain root access to a susceptible device. The flaws are a pre-authentication authorization bypass, tracked as CVE-2026-116606 and rated 9.3, and a command injection vulnerability, CVE-2026-111560, rated 8.6.

CVE-2026-116606 affects the Email Security Gateway. CVE-2026-111560 affects the Email Security Gateway, Load Balancer Application Delivery Controller, Message Archiver, WAF Control Center, Web Application Firewall and Web Security Gateway.

Barracuda said successful exploitation requires access to an affected product’s administrative interface. When used together, the vulnerabilities could let an attacker bypass authorization controls and obtain root access to the device.

The company said devices whose administrative interfaces are not exposed to the internet are less vulnerable to this attack path. It recommends limiting administrative access to trusted internal networks and using network access controls to reduce exposure.

Barracuda also advised customers to check that their systems are running the latest firmware and have received all security patches. Devices several firmware versions behind may require more than one update.

Sources: The Hacker News.