Critical Barracuda Security Flaws Could Let Hackers Bypass Authentication and Gain Root Access

Barracuda has disclosed two security vulnerabilities that could allow attackers to bypass authorization controls and gain root access to affected appliances when exploited together.

The flaws affect several Barracuda security products, but exploitation requires access to a device’s administrative interface, making exposed management systems a key concern for defenders.

The vulnerabilities, tracked as CVE-2026-116606 and CVE-2026-111560, were disclosed on November 2, 2026. Barracuda has released patches and urged customers to install the latest firmware and verify that security updates have reached their devices.

Its advisory does not report active exploitation or identify an associated attack campaign. Barracuda researchers identified the vulnerabilities, not a malware strain.

The distinction matters because the disclosure describes weaknesses in appliance access controls and command handling rather than a documented malware infection.

According to the official Barracuda security advisory, combining these weaknesses could give an attacker root access to an affected device.

Critical Barracuda Security Flaws

CVE-2026-116606 is a pre-authentication authorization bypass affecting Barracuda Email Security Gateway, commonly called ESG.

It carries a CVSS score of 9.3. CVE-2026-111560 is a command injection vulnerability with a score of 8.6 and affects six product families. Barracuda labels both vulnerabilities “High” in its advisory, despite the first flaw’s 9.3 score.

The first weakness concerns authorization controls, while the second involves command injection. Barracuda says the combined attack could bypass those controls and obtain root access.

However, the advisory does not publish vulnerable endpoints, example requests, payloads, or a detailed exploit sequence. Administrators should therefore avoid treating an assumed attack chain as confirmed technical evidence.

Earlier coverage of Barracuda gateway command injection explains how a separate flaw, CVE-2023-2868, enabled system command execution through malicious archive processing.

That historical vulnerability is not one of the newly disclosed issues, and its exploitation method should not be applied to this advisory.

An important limitation remains unresolved in the published details. Barracuda calls CVE-2026-116606 a pre-authentication authorization bypass, yet its advisory also lists “Authentication Required: Yes, administrative access.”

Its overview states that attackers need access to the administrative interface. These statements do not clearly establish whether valid administrator credentials are required for every exploitation scenario.

Only ESG is listed as affected by both vulnerabilities. The command injection flaw also affects Load Balancer Application Delivery Controller, Message Archiver, WAF Control Center, Web Application Firewall, and Web Security Gateway.

The published matrix does not list those five additional products as vulnerable to the authorization bypass. The broader concern is familiar: security appliances can become valuable entry points when exploitable weaknesses remain exposed.

Reporting on most exploited security vulnerabilities previously included Barracuda ESG among products targeted through known flaws. That history provides context for patching urgency, but it does not establish exploitation of these newly disclosed CVEs.

Patches, Administrative Exposure, and Defensive Priorities

Barracuda recommends restricting administrative interfaces to trusted internal networks and applying appropriate network access controls. Organizations whose management interfaces are not publicly accessible face less exposure to this attack path.

Reducing internet exposure is therefore an immediate containment measure, but the vendor still directs customers to update firmware and apply all security patches.

The supplied advisory lists ESG patches BNSF-40425 for versions 9.4.017 and later, and BNSF-40430 for earlier versions.

It identifies BNADC-16586 for ADC and WAF, BNMA-32468 for Message Archiver, BNWF-60060 for WAF Control Center, and BNYF-24789 for Web Security Gateway. These identifiers help administrators verify remediation against the affected product.

Customers should check the latest firmware offered by each appliance and confirm that patches actually installed. Systems several firmware versions behind may require multiple updates.

If automatic patching did not apply an update, Barracuda advises installing it manually as soon as possible and enabling automatic patch delivery where it has been disabled.

Previous reporting on network device root access illustrates why management interfaces deserve close attention during vulnerability response.

For this disclosure, however, administrators should follow Barracuda’s product-specific guidance rather than assume another vendor’s exploit methods or recovery requirements apply. Barracuda Support can help verify firmware and patch status.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally Qdefanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.

The post Critical Barracuda Security Flaws Could Let Hackers Bypass Authentication and Gain Root Access appeared first on Cyber Security News.