Barracuda Flaws Could Be Chained to Bypass Authorization and Gain Root Access

[Starburst-David]

Barracuda has disclosed details of two vulnerabilities affecting its products that, if chained together, could allow an attacker to bypass authorization controls and gain root access to a susceptible device.

The vulnerabilities, a pre-authentication authorization bypass vulnerability and a command injection vulnerability, have been assigned the CVE identifiers CVE-2026-116606 (CVSS score: 9.3) and CVE-2026-111560 (CVSS score: 8.6), respectively.

While CVE-2026-116606 only affects Email Security Gateway, CVE-2026-111560 impacts the following Barracuda products -

• Email Security Gateway

• Load Balancer Application Delivery Controller

• Message Archiver

• WAF Control Center

• Web Application Firewall

• Web Security Gateway

"Successful exploitation requires an attacker to have access to the administrative interface of an affected product," Barracuda said. "If exploited in combination, these vulnerabilities could allow an attacker to bypass authorization controls and obtain root access to the device."


Full article at:
https://thehackernews.com/2026/11/barra ... ed-to.html

Published Date: Nov 03, 2026

Vulnerabilities has been mentioned in this article:
CVE-2026-116606 CVE-2026-111560