Barracuda Flaws Could Be Chained to Bypass Authorization and Gain Root Access

Barracuda has released fixes for two flaws that, when combined, let an attacker with access to a product's admin interface escape authentication and seize full root control of the device. The first, CVE-2026-116606 (CVSS 9.3), is a pre-authentication authorization bypass limited to Email Security Gateway, while the second, CVE-2026-111560 (CVSS 8.6), is a command injection bug affecting a wider set of products including Email Security Gateway, Load Balancer ADC, Message Archiver, WAF Control Center, Web Application Firewall, and Web Security Gateway. Barracuda notes that exploitation requires reaching the administrative console first, so devices with internet-exposed management interfaces face the greatest risk. The vendor recommends restricting admin access to trusted internal networks, applying network access controls, and ensuring devices run the latest firmware, warning that systems several versions behind may need multiple sequential updates to fully remediate.