Barracuda has disclosed details of two vulnerabilities affecting its products that, if chained together, could allow an attacker to bypass authorization controls and gain root access to a susceptible device.
The vulnerabilities, a pre-authentication authorization bypass vulnerability and a command injection vulnerability, have been assigned the CVE identifiers CVE-2026-116606 (CVSS score: 9.3) and CVE-2026-111560 (CVSS score: 8.6), respectively.
While CVE-2026-116606 only affects Email Security Gateway, CVE-2026-111560 impacts the following Barracuda products -
- Email Security Gateway
- Load Balancer Application Delivery Controller
- Message Archiver
- WAF Control Center
- Web Application Firewall
- Web Security Gateway
"Successful exploitation requires an attacker to have access to the administrative interface of an affected product," Barracuda said. "If exploited in combination, these vulnerabilities could allow an attacker to bypass authorization controls and obtain root access to the device."
Barracuda said that organizations that do not expose their administrative interfaces to the internet are less vulnerable to the attack path, urging customers to follow the steps below -
- Restrict access to administrative interfaces to trusted internal networks
- Use appropriate network access controls to limit exposure
"Customers using these products should verify that their systems are running the latest firmware versions and have received all security patches," it added. "If firmware on a device is multiple versions out of date, customers may need to perform more than one update."
