Critical Barracuda Security Flaws Could Let Hackers Bypass Authentication and Gain Root Access

What happened?

Barracuda has disclosed two security vulnerabilities that could allow attackers to bypass authorization controls and gain root access to affected appliances when exploited together. The flaws affect several Barracuda security products, but exploitation requires access to a device’s administrative interface, making exposed management systems a key concern for defenders. The vulnerabilities, tracked as CVE-2026-116606 and CVE-2026-111560, were disclosed on November 2, 2026.

Key details

• The flaws are tracked as CVE-2026-116606 (authorization bypass, CVSS 9.3) and CVE-2026-111560 (command injection, CVSS 8.6), disclosed on November 2, 2026.
• Exploitation requires access to the administrative interface, so exposed management systems are the primary concern.
• Only Email Security Gateway (ESG) is affected by both vulnerabilities; the command injection also affects five other product families.
• Barracuda has released patches for each affected product and urges customers to install the latest firmware and verify updates applied.
• The advisory reports no active exploitation, no associated attack campaign, and no indicators of compromise such as hashes, domains, or malware artifacts.
• Barracuda recommends restricting administrative interfaces to trusted internal networks and applying network access controls as immediate containment.

Summarised by SecOraLens from Cyber Security News. Always read the original source before acting. How SecOraLens verifies advisories.