Barracuda Warns of Two Flaws That Could Give Attackers Full Control of Security Devices

Barracuda has published details of two vulnerabilities affecting its products. Used together, they could allow an attacker to get around authorization controls and gain root access, meaning full control, of a susceptible device. The first, CVE-2026-116606, is a pre-authentication authorization bypass rated 9.3 on the CVSS severity scale. The second, CVE-2026-111560, is a command injection flaw rated 8.6.

Not every product is affected by both issues. CVE-2026-116606 only affects the Email Security Gateway, while CVE-2026-111560 affects a wider range of Barracuda products. The source excerpt mentions a list of affected products but does not include it, so businesses should check Barracuda's own advisory for specifics.

Barracuda says successful exploitation requires the attacker to have access to the device's administrative interface. Organizations that do not expose that interface to the internet are less vulnerable to this attack path. The company urges customers to confirm their systems are running the latest firmware and have received all security patches. If a device is several versions out of date, more than one update may be needed.