Barracuda security appliances hit by two critical vulnerabilities
Original title: Barracuda’s security appliances have a security problem of their own
Patches released for CVE-2026-116606 authorization bypass and CVE-2026-111560 command injection in Barracuda Email Security Gateway and other products.
Barracuda disclosed two critical vulnerabilities in its security appliances that could allow root access if chained. CVE-2026-116606 is a pre-authentication authorization bypass rated 9.3 critical while CVE-2026-111560 is a command injection rated 8.6 high. Both affect the Email Security Gateway but CVE-2026-111560 also impacts Web Security Gateway, WAF, WCC, Load Balancer ADC and Message Archiver. The company released patches and advises immediate application.
Unconfirmed: Whether vulnerabilities are being exploited in the wild is unknown
- Patches available for latest firmware versions
- Affects ESG, WSG, WAF, WCC, ADC and BMA
- Restrict admin interface access to internal networks
- Chaining vulnerabilities could enable root access
- Historical 2023 ESG compromise noted
Impact: root access via chained authorization bypass and command injection
- 1.apply security patches
- 2.restrict admin interface access
- 3.verify patches installed
- Vendors
- Barracuda
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-111560 | Command Injection in Barracuda Appliance Timezone Field | 8.6 | — | ||
| CVE-2026-116606 | Auth bypass in Barracuda Email Security Gateway before 9.4.0.030 | 9.3 | — |
From the original article
4 min read at csoonline.com
Barracuda, which offers a wide variety of cybersecurity devices, has been bitten by a bug itself. The company has disclosed two critical and high-severity vulnerabilities that, if chained together, could allow threat actors to bypass authorization controls and gain root access to devices. They consist of a pre-authentication authorization bypass vulnerability, tracked as CVE-2026-116606 (rated a critical 9.
csoonline.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.