Barracuda flaws can be chained to gain root access

Barracuda has disclosed two vulnerabilities in its products that, if chained together, could bypass authorisation and grant root access to a compromised device. The issues are CVE-2026-116606, a pre-authentication authorisation bypass with a CVSS score of 9.3, and CVE-2026-111560, a command injection with a CVSS score of 8.6.

CVE-2026-116606 affects the Email Security Gateway, while CVE-2026-111560 affects Email Security Gateway, Load Balancer Application Delivery Controller, Message Archiver, WAF Control Center, Web Application Firewall, and Web Security Gateway. Barracuda states that exploitation requires access to the affected product’s administrative interface, and that, if chained, an attacker could bypass authorisation and obtain root access to the device.

Barracuda notes that organisations not exposing administrative interfaces to the internet are less vulnerable to this attack path. To mitigate risk, the company urges restricting administrative access to trusted internal networks and applying appropriate network access controls to limit exposure.

Customers are advised to ensure firmware is up to date and that all security patches have been applied; where firmware is several versions out of date, multiple updates may be required to cover the chain of vulnerabilities. Barracuda emphasises verifying systems are on the latest firmware and patched versions as part of a careful update process.

The firm attributed the information to its own security advisory and emphasised that successful exploitation hinges on access to the administrative interface and on combining the two vulnerabilities.