Barracuda discloses authorization bypass and command injection flaws
Original title: Critical Barracuda Security Flaws Could Let Hackers Bypass Authentication and Gain Root Access
Barracuda patched CVE-2026-116606 and CVE-2026-111560 which together could allow root access to affected appliances when exploited with administrative interface access.
Barracuda disclosed two flaws affecting Email Security Gateway and five other security product families. CVE-2026-116606 is a pre-authentication authorization bypass rated 9.3 while CVE-2026-111560 is a command injection flaw rated 8.6. The vendor states the combination could grant root access but does not publish proof-of-concept or exploitation details. Patches were released for multiple firmware versions across products and customers must verify installation.
Unconfirmed: Whether valid administrator credentials are required for every exploitation path
- Only ESG listed for both CVEs
- Command injection affects six product families
- Patches include BNSF-40425 and BNSF-40430
- No active exploitation reported
- Administrative access required per advisory
Impact: root access to affected appliances
- 1.upgrade to patched firmware
- 2.restrict administrative interface access
- 3.verify patch status via product IDs like BNSF-40425
- Vendors
- Barracuda
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-111560 | Command Injection in Barracuda Appliance Timezone Field | 8.6 | — | ||
| CVE-2026-116606 | Auth bypass in Barracuda Email Security Gateway before 9.4.0.030 | 9.3 | — |
From the original article
3 min read at cybersecuritynews.com
Barracuda has disclosed two security vulnerabilities that could allow attackers to bypass authorization controls and gain root access to affected appliances when exploited together. The flaws affect several Barracuda security products, but exploitation requires access to a device’s administrative interface, making exposed management systems a key concern for defenders.
By Tushar Subhra Dutta · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.