Barracuda discloses two critical vulnerabilities allowing root access
GBHackers on November 4 adds CVSS ratings of 9.3 and 8.6, five additional product families affected by command injection only, no active exploitation, and historical zero-day linked to UNC4841.
Two critical vulnerabilities in Barracuda products could enable root access if chained and admin interfaces exposed; patches released and access restricted to internal networks.
On November 2, 2026, the Canadian Centre for Cyber Security issued alert AV26-1112 for Barracuda Networks products affected by pre-authentication authorization bypass (CVE-2026-116606) and command injection (CVE-2026-111560). Patches are available for affected versions including Email Security Gateway before 9.4.0.030. Exploitation requires administrative interface access, which organizations should restrict to trusted internal networks. No active exploitation observed.
- CVE-2026-116606 affects Email Security Gateway before 9.4.0.030
- CVE-2026-111560 impacts ESG, WSG, WAF, WCC, ADC and Message Archiver
- Patches available for versions 9.4.0.030 and later
- Requires admin interface access for root compromise
- Chained vulnerabilities could enable full root access
- No active exploitation reported
Timeline
dated events in the reporting · oldest first- Nov 2, 2026Canadian Centre for Cyber Security issues AV26-1112 for Barracuda vulnerabilities · Canadian Centre for Cyber Security
- Nov 3, 2026BleepingComputer and The Hacker News report on CVEs and chaining · BleepingComputer
- Nov 3, 2026BleepingComputer and The Hacker News report on CVEs and chaining · The Hacker News
- Nov 4, 2026CSO Online reports patches and severity ratings · CSO Online
- Nov 4, 2026GBHackers reports patches, no active exploitation and UNC4841 link · GBHackers
What each outlet adds
beyond the shared facts- Canadian Centre for Cyber Securityissued alert AV26-1112 for pre-auth and command injection
- BleepingComputeridentified CVEs and root access potential
- The Hacker Newsnoted possibility of chaining vulnerabilities
- CSO Onlineadded severity ratings and historical 2023 compromise
- GBHackersCVSS scores, no active exploitation and UNC4841 link
- Vendors
- BarracudaBarracuda Networks
- Products
- Email Security GatewayWeb Security GatewayWeb Application FirewallWAF Control CenterLoad Balancer Application Delivery ControllerMessage ArchiverBarracuda Email Security GatewayBarracuda Load Balancer ADCBarracuda Web Application FirewallBarracuda Web Security GatewayBarracuda Message ArchiverBarracuda WAF Control Center
- Organizations
- Canadian Centre for Cyber Security
Coverage
oldest first · one row per article · UTC- · 1d ago
Canadian Centre for Cyber SecurityFirst report
Barracuda products have pre-auth bypass and command injection flaws
Six Barracuda gateways and management products below stated builds are affected; the Cyber Centre says updates are available.
- · 17h ago
BleepingComputer
Barracuda critical flaws allow root access to devices
Two critical vulnerabilities in Barracuda ESG and related products could enable root access; patches released for affected versions.
- · 16h ago
The Hacker News
Barracuda flaws chained to bypass authorization and gain root access
Chaining the two vulnerabilities allows root access if the admin interface is accessible; restrict admin exposure to internal networks and update firmware.
- · 3h ago
CSO Online
Barracuda security appliances hit by two critical vulnerabilities
Patches released for CVE-2026-116606 authorization bypass and CVE-2026-111560 command injection in Barracuda Email Security Gateway and other products.
- · 2h ago
GBHackers
Barracuda Email Security Gateway flaws expose devices to root compromise
CVE-2026-116606 and CVE-2026-111560 could enable root access on ESG appliances.
Vulnerabilities in this story
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-111560 | Command Injection in Barracuda Appliance Timezone Field | 8.6 | — | ||
| CVE-2026-116606 | Auth bypass in Barracuda Email Security Gateway before 9.4.0.030 | 9.3 | — |