Barracuda Discloses Critical Flaws Enabling Root Access via Chained Exploitation
Barracuda has disclosed two critical vulnerabilities, CVE-2026-116606 and CVE-2026-111560, that can be chained to bypass authorization and gain root access on its security appliances. The first flaw, a pre-authentication authorization bypass, affects only the Email Security Gateway, while the second, a command injection vulnerability, impacts a wide range of products including load balancers, web application firewalls, and message archivers. Although the command injection flaw has a CVSS score of 8.6 and the authorization bypass scores 9.3, successful exploitation requires an attacker to already have access to the administrative interface of the affected device. Barracura advises organizations to restrict administrative interface access to trusted internal networks and ensure all systems are running the latest firmware, noting that devices multiple versions behind may require multiple updates to reach a secure state.
