Barracuda Flaws Could Be Chained to Bypass Authorization and Gain Root Access
Barracuda has disclosed details of two vulnerabilities affecting its products that, if chained together, could allow an attacker to bypass authorization controls and gain root access to a susceptible device.
Barracuda has disclosed details of two vulnerabilities affecting its products that, if chained together, could allow an attacker to bypass authorization controls and gain root access to a susceptible device.
The vulnerabilities, a pre-authentication authorization bypass vulnerability and a command injection vulnerability, have been assigned the CVE identifiers CVE-2026-116606 (CVSS score: 9.3) and CVE-2026-111560 (CVSS score: 8.6), respectively.
While CVE-2026-116606 only affects Email Security Gateway, CVE-2026-111560 impacts the following Barracuda products - Barracuda said.
Barracuda said that organizations that do not expose their administrative interfaces to the internet are less vulnerable to the attack path, urging customers to follow the steps below - it added.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA), on November 10, 2026, added both CVE-2026-111560 and CVE-2026-116606 to its Known Exploited Vulnerabilities (KEV) catalog, requiring Federal Civilian Executive Branch (FCEB) agencies to apply the patch by November 13, 2026.
It did not provide any further details of the exploitation activity.
What happened
Barracuda has disclosed details of two vulnerabilities affecting its products that, if chained together, could allow an attacker to bypass authorization controls and gain root access to a susceptible device.
The vulnerabilities, a pre-authentication authorization bypass vulnerability and a command injection vulnerability, have been assigned the CVE identifiers CVE-2026-116606 (CVSS score: 9.3) and CVE-2026-111560 (CVSS score: 8.6), respectively.
While CVE-2026-116606 only affects Email Security Gateway, CVE-2026-111560 impacts the following Barracuda products - Barracuda said.
What changed
Barracuda said that organizations that do not expose their administrative interfaces to the internet are less vulnerable to the attack path, urging customers to follow the steps below - it added.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA), on November 10, 2026, added both CVE-2026-111560 and CVE-2026-116606 to its Known Exploited Vulnerabilities (KEV) catalog, requiring Federal Civilian Executive Branch (FCEB) agencies to apply the patch by November 13, 2026.
Technical details
It did not provide any further details of the exploitation activity.
What to watch next
Watch for additional victim details, indicators of compromise and follow-on exploitation reports.
Watch for revised vendor guidance, fixed versions and mitigation updates.