Barracuda Flaws Could Be Chained to Bypass Authorization and Gain Root Access
Summary
Barracuda disclosed two flaws that could be chained to bypass authorization and gain root access on affected devices. Exploitation requires access to an affected product’s administrative interface; customers should install the latest firmware and patches.
Key points
- CVE-2026-116606 is a pre-authentication authorization bypass with a CVSS score of 9.3; it affects Barracuda Email Security Gateway.
- CVE-2026-111560 is a command injection flaw with a CVSS score of 8.6; the supplied article text does not include the affected-product list.
- Barracuda says chaining the vulnerabilities could bypass authorization controls and provide root access.
- Successful exploitation requires access to an affected product’s administrative interface.
- Barracuda advises customers to install the latest firmware and security patches; devices several versions behind may require multiple updates.
Article Details
- Vulnerability Types
- Pre-authentication authorization bypass
- Command injection
- Severity
- CVE-2026-116606: CVSS 9.3; CVE-2026-111560: CVSS 8.6
- Exploitation Status
- unknown
- Exploit Availability
- unknown
- Patch Status
- available
- Workarounds
- Do not expose administrative interfaces to the internet.
MITRE ATT&CK
CVE
CVE-2026-111560Vendor / Product unavailablevulnerability, have been assigned the CVE identifiers CVE-2026-116606 (CVSS score: 9.3) and CVE-2026-111560 (CVSS score: 8.6), respectively.CVE-2026-116606Vendor / Product unavailablebypass vulnerability and a command injection vulnerability, have been assigned the CVE identifiers CVE-2026-116606 (CVSS score: 9.3) and CVE-2026-111560 (CVSS score: 8.6), respectively.