Barracuda has revealed two significant security issues that, when combined, could allow attackers to bypass authentication measures and gain root access to certain devices. These vulnerabilities are pertinent to several Barracuda security products, necessitating access to the administrative interface for exploitation, which highlights the need for secure management systems.
Details of the Security Vulnerabilities
The vulnerabilities are identified as CVE-2026-116606 and CVE-2026-111560, disclosed on November 2, 2026. Barracuda has immediately released patches and advised users to update their firmware, ensuring all security updates are applied. Although no active exploitations have been reported, the vulnerabilities were discovered internally by Barracuda researchers, focusing on access control weaknesses rather than malware.
According to the advisory, exploiting these vulnerabilities in tandem could provide attackers with root access to affected devices. CVE-2026-116606 is a pre-authentication authorization bypass affecting Barracuda Email Security Gateway (ESG) with a CVSS score of 9.3, while CVE-2026-111560 is a command injection flaw affecting multiple product families with a score of 8.6.
Implications and Product Impact
The vulnerabilities emphasize the need for stringent access controls. Barracuda has labeled both vulnerabilities as ‘High’ risk, recommending that administrators restrict administrative interfaces to trusted networks and ensure all security patches are applied. The advisory does not list specific exploit sequences but warns against assuming an attack chain without technical evidence.
While only ESG is affected by both vulnerabilities, the command injection issue extends to five other product lines. The advisory highlights the ongoing risk of security appliances being exploited if vulnerabilities remain unpatched, urging immediate attention to patching protocols.
Recommendations and Defensive Measures
Barracuda advises limiting management interface exposure to internal networks and applying appropriate network access controls. The advisory specifies patch identifiers for various products, urging customers to confirm that updates have been correctly installed.
For systems lagging in firmware updates, Barracuda recommends manual installations and enabling automatic updates if disabled. Administrators should adhere to product-specific guidance to ensure effective vulnerability management and consult Barracuda Support for further assistance.
No indicators of compromise have been published, emphasizing the importance of proactive measures in maintaining network security and preventing potential exploitation of these vulnerabilities.
