"Successful exploitation requires an attacker to have access to the administrative interface of an affected product," Barracuda said.
Barracuda disclosure and the tracked flaws
Barracuda has disclosed two vulnerabilities that, when combined, could let an attacker bypass authorization controls and obtain root access on a vulnerable device. The issues are tracked as CVE-2026-116606 (CVSS 9.3) and CVE-2026-111560 (CVSS 8.6). Barracuda described the first as a pre-authentication authorization bypass and the second as a command injection vulnerability. Taken together, the vendor warned, the flaws create a chained attack path that could lead to full device compromise.
Which products are affected and which is limited
The two flaws do not have identical scope. Barracuda said CVE-2026-116606 affects only Email Security Gateway. CVE-2026-111560, the command injection issue, impacts a broader set of products:
- Email Security Gateway
- Load Balancer Application Delivery Controller
- Message Archiver
- WAF Control Center
- Web Application Firewall
- Web Security Gateway
Where both issues are present on the same device, Barracuda cautioned, exploitation in combination could allow an attacker to bypass authorization controls and obtain root access to the device.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleAttack precondition: administrative-interface access
Barracuda emphasized a specific precondition for successful exploitation: access to the administrative interface of an affected product. The vendor’s disclosure states plainly that an attacker must have access to that interface to exploit the chain. As a practical corollary, Barracuda noted that organizations that do not expose administrative interfaces to the internet are less vulnerable to the described attack path.
Barracuda's mitigation steps for customers
Alongside the technical details and CVE identifiers, Barracuda supplied direct mitigation guidance for customers. The vendor urged users to:
- Restrict access to administrative interfaces to trusted internal networks.
- Use appropriate network access controls to limit exposure.
- Verify that systems are running the latest firmware versions and have received all security patches.
Barracuda added a practical note on patching cadence: if firmware on a device is multiple versions out of date, customers may need to perform more than one update to reach the secure release.
What this means for technologists, network administrators, and procurement leaders
- Technologists and security teams should confirm whether their estate includes any of the named Barracuda products and, where present, verify firmware and patch status against the vendor’s releases.
- Network and systems administrators should ensure administrative interfaces are not exposed to the internet and apply network access controls to limit who can reach management endpoints.
- Procurement and asset managers should inventory deployed Barracuda devices to identify models running Email Security Gateway, Load Balancer ADC, Message Archiver, WAF Control Center, Web Application Firewall, or Web Security Gateway and plan for staged updates if devices are multiple firmware versions behind.
The technical facts in Barracuda’s disclosure are narrow but consequential: two distinct vulnerabilities, one enabling unauthorized access and the other enabling command injection, can be combined to elevate an attacker to root on affected devices, provided they can reach the administrative interface. Barracuda’s mitigations point to a defensive posture centered on limiting administrative access and maintaining up-to-date firmware, while acknowledging that remediation may require multiple updates for older installations.
For organizations running any of the listed products, the immediate steps are clear and concrete in Barracuda’s own words: verify firmware, harden administrative access, and apply the security patches the vendor has provided. Whether those steps are already in progress across affected deployments will determine how widely the chain described by CVE-2026-116606 and CVE-2026-111560 can be realized.
