Barracuda flaws chained to bypass authorization and gain root access
Original title: Barracuda Flaws Could Be Chained to Bypass Authorization and Gain Root Access
Chaining the two vulnerabilities allows root access if the admin interface is accessible; restrict admin exposure to internal networks and update firmware.
Barracuda disclosed two vulnerabilities that can be chained together. CVE-2026-116606 is a pre-authentication authorization bypass affecting Email Security Gateway. CVE-2026-111560 is a command injection vulnerability impacting Email Security Gateway, Load Balancer Application Delivery Controller, Message Archiver, WAF Control Center, Web Application Firewall and Web Security Gateway. Successful exploitation requires access to the administrative interface of an affected product. Organizations not exposing these interfaces to the internet are less vulnerable.
- Vulnerabilities can be chained for authorization bypass and root access
- Exploitation needs administrative interface access
- Restrict admin interfaces to trusted internal networks
- Use network access controls to limit exposure
- Update to latest firmware versions
Impact: bypass authorization controls and obtain root access to the device
| Product | Affected | Fixed in |
|---|---|---|
| Barracuda Email Security Gateway | — | latest firmware versions |
| Barracuda Load Balancer Application Delivery Controller | — | latest firmware versions |
| Barracuda Message Archiver | — | latest firmware versions |
| Barracuda WAF Control Center | — | latest firmware versions |
| Barracuda Web Application Firewall | — | latest firmware versions |
| Barracuda Web Security Gateway | — | latest firmware versions |
- 1.Restrict access to administrative interfaces to trusted internal networks
- 2.Use appropriate network access controls to limit exposure
- 3.Verify systems are running the latest firmware versions
- Tags
- barracudaauthorization-bypassroot-accesscommand-injectionemail-security-gatewayweb-application-firewall
- Vendors
- Barracuda
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-111560 | Command Injection in Barracuda Appliance Timezone Field | 8.6 | — | ||
| CVE-2026-116606 | Auth bypass in Barracuda Email Security Gateway before 9.4.0.030 | 9.3 | — |
From the original article
1 min read at thehackernews.com
Barracuda has disclosed details of two vulnerabilities affecting its products that, if chained together, could allow an attacker to bypass authorization controls and gain root access to a susceptible device. The vulnerabilities, a pre-authentication authorization bypass vulnerability and a command injection vulnerability, have been assigned the CVE identifiers CVE-2026-116606 (CVSS score: 9. 3)
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.