Barracuda Patches Critical Root-Access Flaws in Email Security Gateway and Load Balancer Products
Barracuda Networks has issued patches for two vulnerabilities that, combined, could let an attacker with administrative interface access escalate to root privileges on affected devices. CVE-2026-116606 is a critical pre-authentication authorization bypass in the Email Security Gateway (ESG) that allows modification of an appliance's global configuration, while CVE-2026-111560 is a command injection flaw that enables an attacker with admin permissions to execute OS commands as root; this second flaw also affects the Load Balancer Application Delivery Controller and other Barracuda products beyond the ESG (thehackernews.com). Barracuda notes that exploitation requires prior access to the device's administrative interface, and recommends restricting such access to trusted internal networks via network access controls. The company has already released firmware patches across affected product lines.
Entenda a falha
A vulnerabilidade
Two Barracuda flaws can be chained to get root. CVE-2026-116606 (CVSS 9.3) is a pre-authentication authorization bypass in the Email Security Gateway (ESG) only, and it lets an attacker modify the appliance's global configuration. CVE-2026-111560 (CVSS 8.6) is an OS command injection that lets an attacker with admin permissions run commands as root. It affects the Load Balancer Application Delivery Controller and other Barracuda products besides the ESG. Barracuda says exploitation requires access to the administrative interface. The articles give no affected or fixed firmware versions. Barracuda has released firmware patches, and devices several versions behind may need more than one update.
Como funciona
The articles give little mechanism detail. An attacker who can reach the administrative interface of an ESG first exploits the authorization bypass, which works before authentication and lets them change the appliance's global configuration. Then, with admin-level permissions, they send input that the product passes to the operating system as commands, and those commands run as root. The articles do not say which component, endpoint or parameter is involved.
Por que é vulnerável
The articles do not explain the root causes in detail. CVE-2026-116606 is an authorization bypass: a check that should block unauthenticated changes to the global configuration does not hold. BleepingComputer called it an authentication weakness, while The Hacker News, citing Barracuda's disclosure, calls it a pre-authentication authorization bypass. CVE-2026-111560 is a command injection, where input reaches the operating system in a way that lets commands run with root privileges. The articles do not describe what the patches change.
Como foi descoberta
The articles do not say who found the flaws or how. Barracuda disclosed both in an advisory, said it immediately started a remediation process and released security patches. The articles do not report exploitation of these two CVEs. They mention the older ESG flaws CVE-2023-2868 and CVE-2023-7102, exploited as zero-days by UNC4841, only as background.
Explicação gerada por IA a partir da matéria e dos artigos, em 03/11/2026 15:16.
Detalhes técnicos
The two flaws can be chained: CVE-2026-116606 allows bypassing authorization controls via the ESG through a pre-authentication authorization bypass (thehackernews.com), and CVE-2026-111560 then permits OS command injection running with root privileges across multiple affected products including the Load Balancer Application Delivery Controller (thehackernews.com), giving an attacker full device compromise once admin-interface access is obtained.
Remediação
Barracuda urges customers to apply the latest firmware and all security patches for affected products, restrict administrative interface access using network access controls limited to trusted internal networks, and notes that devices multiple firmware versions out of date may require sequential updates to fully remediate (thehackernews.com).
Relatos divergentes
An earlier report described CVE-2026-116606 as an authentication weakness allowing modification of global configuration; Barracuda's own disclosure (thehackernews.com, more recent) characterizes it specifically as a pre-authentication authorization bypass vulnerability.
Linha do tempo
-
Barracuda Discloses Chainable Auth-Bypass and Command Injection Flaws Allowing Root Access
This article clarifies the nature of the two vulnerabilities, describing **CVE-2026-116606** as a pre-authentication authorization bypass (rather than an authentication weakness) and confirming that **CVE-2026-111560**, the command injection flaw, affects multiple Barracuda products including the **Load Balancer Application Delivery Controller**, expanding the known affected product scope beyond the Email Security Gateway.
ler a análise desta fonte ocultar
This article clarifies the nature of the two vulnerabilities, describing CVE-2026-116606 as a pre-authentication authorization bypass (rather than an authentication weakness) and confirming that CVE-2026-111560, the command injection flaw, affects multiple Barracuda products including the Load Balancer Application Delivery Controller, expanding the known affected product scope beyond the Email Security Gateway.
Barracuda Networks disclosed technical details of two vulnerabilities that can be chained to bypass authorization controls and gain root access on affected appliances. CVE-2026-116606 (CVSS 9.3) is a pre-authentication authorization bypass affecting the Email Security Gateway, while CVE-2026-111560 (CVSS 8.6) is a command injection flaw impacting multiple products including the Load Balancer Application Delivery Controller. Exploitation requires an attacker to already have access to the administrative interface of an affected device. Barracuda recommends restricting admin interface exposure to trusted internal networks and applying the latest firmware patches.
Technical Details
Chaining the pre-authentication authorization bypass (CVE-2026-116606) with the command injection flaw (CVE-2026-111560) allows an attacker to bypass authorization controls and obtain root access on a susceptible device, provided they can reach the administrative interface.
Remediation
Barracuda urges customers to restrict administrative interface access to trusted internal networks, apply appropriate network access controls, and verify systems are running the latest firmware with all security patches, noting that devices multiple versions out of date may require sequential updates.
-
Barracuda Patches Critical Root-Access Flaws in Email Security Gateway and Other Appliances
ler a análise desta fonte ocultar
Barracuda Networks has issued patches for two vulnerabilities that, combined, could let an attacker with administrative interface access escalate to root privileges on affected devices. CVE-2026-116606 is a critical authentication weakness in the Email Security Gateway (ESG) that allows modification of an appliance's global configuration, while CVE-2026-111560 enables an attacker with admin permissions to inject OS commands executed as root. Barracuda notes that exploitation requires prior access to the device's administrative interface, and recommends restricting such access to trusted internal networks via network access controls. The company has already released firmware patches across affected product lines.
Technical Details
The two flaws can be chained: CVE-2026-116606 allows bypassing authorization controls via the ESG, and CVE-2026-111560 then permits OS command injection running with root privileges, giving an attacker full device compromise once admin-interface access is obtained.
Remediation
Barracuda urges customers to apply the latest firmware and all security patches for affected products, and to restrict administrative interface access using network access controls limited to trusted internal networks.