Barracuda Flaws Could Be Chained to Bypass Authorization and Gain Root Access
Summary: Barracuda disclosed two vulnerabilities, CVE-2026-116606 (CVSS 9.3), a pre-authentication authorization bypass affecting Email Security Gateway, and CVE-2026-111560 (CVSS 8.6), a command injection affecting multiple Barracuda products, which if chained could bypass authorization controls and obtain root access. Barracuda confirmed on November 9, 2026 that it had identified exploitation activity affecting a small number of organizations, and CISA added both flaws to its KEV catalog on November 10, 2026 with a patch deadline of November 13, 2026 for FCEB agencies.
Key Takeaway: Barracuda has already confirmed real exploitation against a small number of organizations, and the chain requires only access to the administrative interface - so any Barracuda admin panel reachable from the internet is the exposure that matters, and FCEB agencies have until November 13, 2026 to patch.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2026-111560CVE-2026-116606
- Related
- CISA Adds Six Known Exploited Vulnerabilities to Catalog Cyber Risks · Nov 10, 2026Experts Demonstrate Barracuda Email Security Gateway Chain Enabling Root Access Without Login Cyber Risks ·CVE-2026-116606: Barracuda Networks Email Security Gateway (ESG) Authentication Bypass Using an Alternate Path or Channel Vulnerability Known Exploited Vulnerabilities · Nov 10, 2026