Summary
- CVE-2026-116606 and CVE-2026-111560 affect specified Barracuda products.
- On affected Email Security Gateway systems, the vulnerabilities could be combined to obtain root privileges.
- Barracuda has published patches and recommends restricting access to administrative interfaces.
Barracuda has released security patches for two vulnerabilities affecting enterprise security appliances, including a combination that could allow attackers to bypass authorisation controls and obtain root access.
The vulnerabilities, CVE-2026-116606 and CVE-2026-111560, were disclosed on 2 November and affect different parts of the company’s product portfolio.
Successful exploitation requires an attacker to reach an affected product’s administrative interface. The precise exposure depends on the appliance, its installed patches, and the network controls governing access to management functions.
CVE-2026-116606 is an authorisation bypass vulnerability affecting Barracuda Email Security Gateway, with a CVSS score of 9.3.
CVE-2026-111560 is a command injection vulnerability, rated 8.6, that affects several products including Email Security Gateway, Web Application Firewall, Web Security Gateway, and selected application delivery and archiving appliances.
Combined vulnerabilities create elevated access
Email Security Gateway is affected by both vulnerabilities, enabling the combined attack scenario described in the vendor’s advisory.
Where an attacker can reach a vulnerable administrative interface and successfully exploit the flaws together, authorisation restrictions may be bypassed and commands executed with root privileges.
That level of access provides extensive control over the affected appliance, potentially allowing changes to configuration, processes, and the functions performed by the device.
Other Barracuda products listed in the advisory are affected by the command injection vulnerability but not necessarily the same authorisation bypass.
Consequently, the combined Email Security Gateway attack path should not be presented as universally applicable to every listed Barracuda appliance.
The company has published separate patch references and remediation instructions for the affected product families.
Some installations can receive the necessary fixes through automatic update arrangements, while others require administrators to apply firmware or security patches manually.
Management interfaces affect exposure
Security appliances frequently occupy privileged positions within enterprise networks.
Email gateways process communications entering and leaving an organisation. Web application firewalls inspect application traffic, while delivery controllers and related infrastructure support the availability and routing of business services.
The administrative functions governing those appliances can modify security policies, network configurations, and operational settings.
Exposing such interfaces to untrusted networks therefore increases the opportunities available to attackers attempting to compromise them.
Barracuda advises customers to restrict administrative access to trusted internal networks and implement appropriate network controls.
This recommendation applies alongside patching because a management interface remains a privileged service even after a particular vulnerability has been corrected.
Where devices have fallen several firmware versions behind, reaching a current supported release may require multiple update steps.
Administrators must also confirm that the applicable security patches have actually been installed, rather than assuming that a firmware version alone establishes protection.
Security infrastructure requires its own assurance
The vulnerabilities demonstrate the operational consequences of weaknesses within products deployed specifically to protect other systems.
An appliance may enforce access restrictions or inspect traffic while maintaining administrative interfaces that themselves require strong authentication, patch management, and monitoring.
Compromise of those interfaces could affect the controls implemented through the appliance and potentially expose information processed by it.
However, the existence of a root-access vulnerability does not establish that customers have experienced such consequences.
Barracuda’s initial advisory does not identify a confirmed exploitation campaign or provide evidence that attackers have used the vulnerabilities against customer environments.
The assessment of risk therefore rests on the documented technical capabilities, the affected versions, and the accessibility of administrative interfaces.
Customers are directed to the company’s product-specific guidance to verify firmware versions and ensure the necessary patches have been applied.
The advisory remains a remediation notice for confirmed product vulnerabilities, with real-world exploitation and customer impact not established in the information released on 2 November.
