Barracuda Fixes Two Flaws That Could Be Chained to Gain Root Access
Barracuda has released fixes for two serious flaws in its network devices. Exploiting them together could give an attacker root access if they reach the administrative interface.
Barracuda published fixes on November 2, 2026, as part of its Barracuda vulnerability fixes. According to the vendor, exploiting two security flaws together could bypass authorization checks and give an attacker root access to an affected device.
These are CVE-2026-116606, a flaw enabling pre-authentication authorization bypass, and CVE-2026-111560, a command injection vulnerability. Barracuda rates them High severity, with CVSS scores of 9.3 and 8.6. The designation “critical” therefore does not match the vendor’s classification.
Barracuda vulnerability fixes: affected products
CVE-2026-116606 affects Email Security Gateway. The second flaw, CVE-2026-111560, affects Load Balancer ADC, Message Archiver, WAF Control Center, Web Application Firewall, and Web Security Gateway.
To successfully chain the flaws, an attacker must have access to the affected product’s administrative interface. This is therefore not a confirmed scenario involving a completely unauthenticated attack directly from the internet. However, the risk increases where the administrative interface is accessible outside a trusted internal network.
What administrators should do
Barracuda has released patches and recommends updating the firmware, applying the relevant patches, and restricting access to administrative interfaces to trusted internal networks. Organizations should verify the firmware version and confirm that automatic or manual updates completed successfully.
The affected devices handle email and web communications or protect network traffic. Root access could allow an attacker to change configuration, deploy malicious code, or continue moving through the network.
No confirmed exploitation so far
Barracuda does not state in its advisory that these vulnerabilities are being actively exploited. It will be important to see whether the vendor or government security authorities publish information about attacks in the wild and whether administrators remove public access to administrative interfaces.
Sources
- Barracuda Networks Security Advisory – Confirms the CVEs, affected products, the requirement for access to the administrative interface, the possibility of obtaining root access after chaining the flaws, and the availability of fixes.
- BleepingComputer – Independently reports Barracuda’s release of fixes for two flaws that could lead to command execution with root privileges.
Verified and updated: November 3, 2026 16:36
