Barracuda discloses flaw chain that can grant root access

Barracuda has disclosed two vulnerabilities that can be chained to bypass authorization controls and obtain root access on susceptible appliances. The issues are CVE-2026-116606, a pre-authentication authorization bypass rated 9.3 on the CVSS scale, and CVE-2026-111560, a command-injection vulnerability rated 8.6.

The company said successful exploitation requires an attacker to have access to the administrative interface of an affected product. Used together, the vulnerabilities could let that attacker circumvent authorization controls and gain root-level access to the device.

Products affected by the two vulnerabilities

CVE-2026-116606 affects Barracuda Email Security Gateway only. CVE-2026-111560 has a broader product footprint, affecting Email Security Gateway, Load Balancer, Application Delivery Controller, Message Archiver, WAF Control Center, Web Application Firewall and Web Security Gateway.

The distinction matters for asset inventories and patching plans. An organization may have several Barracuda appliances exposed to the command-injection issue, while the reported authorization-bypass component of the chain is limited to Email Security Gateway.

Administrative interface exposure is central

Barracuda said devices whose administrative interfaces are not exposed to the internet are less vulnerable to this attack path. The stated prerequisite does not remove the need to patch, but it makes administrative-interface access a priority for teams assessing exposure.

The company advises customers to restrict administrative interfaces to trusted internal networks and to use appropriate network access controls to limit exposure. These controls directly address the access condition Barracuda identified for successful exploitation.

Firmware verification and update planning

Barracuda also instructed customers using the affected products to verify that systems are on the latest firmware releases and have received all security patches. Teams should check each relevant appliance rather than treating the product family as a single update target, because the two CVEs do not apply to identical product lists.

For devices that are multiple firmware versions behind, Barracuda noted that more than one update may be required. The practical business implication is to inventory exposed administrative interfaces, restrict them to trusted networks, verify firmware and patch status, and schedule any required staged upgrades before the flaw chain can be used against a susceptible device.