Cybersecurity
Barracuda disclosed two flaws in its products
Barracuda said two vulnerabilities in its products could be chained to bypass authorisation controls and gain root access on affected devices if an attacker reached the administrative interface.
- Barracuda disclosed two vulnerabilities affecting its products.
- It assigned CVE-2026-116606 a CVSS score of 9.3 and described it as a pre-authentication authorisation bypass issue.
- It assigned CVE-2026-111560 a CVSS score of 8.6 and described it as a command injection issue.
- Barracuda said the first flaw affected Email Security Gateway, while the second affected six Barracuda products.
- The company said customers should restrict administrative interfaces to trusted internal networks and install the latest firmware and security patches.
Barracuda said the two vulnerabilities could be used together to bypass authorisation controls and reach root access on a susceptible device. It said exploitation required access to the administrative interface of an affected product.
The company identified the flaws as CVE-2026-116606 and CVE-2026-111560. It said the first was a pre-authentication authorisation bypass issue rated 9.3 on the CVSS scale, and the second was a command injection issue rated 8.6.
Barracuda said CVE-2026-116606 affected only Email Security Gateway. It said CVE-2026-111560 affected Email Security Gateway, Load Balancer Application Delivery Controller, Message Archiver, WAF Control Center, Web Application Firewall and Web Security Gateway.
The company said organisations that did not expose administrative interfaces to the internet were less exposed to the attack path. It urged customers to limit access to trusted internal networks, apply network controls and make sure their firmware and security patches were current.
Named in this story
Companies
- Barracuda
- disclosed the vulnerabilities and advised customers on mitigation
Products and systems
- Email Security Gateway
- was affected by both vulnerabilities
- Load Balancer Application Delivery Controller
- was affected by the command injection flaw
- Message Archiver
- was affected by the command injection flaw
- WAF Control Center
- was affected by the command injection flaw
- Web Application Firewall
- was affected by the command injection flaw
- Web Security Gateway
- was affected by the command injection flaw
How the source tells it
The piece read as a plain security advisory, with cautious conditional language rather than emotive framing.
No emotive framing was found in the original.