- Barracuda disclosed two flaws, CVE-2026-116606 and CVE-2026-111560, which it says could give an attacker root access if exploited in combination.
- Barracuda says exploitation requires access to the administrative interface, and that organizations not exposing it to the internet are less exposed.
- Check firmware on every listed Barracuda product, apply the patches, and confirm who can reach each admin page.
The control panel of a security product is a door too
A security appliance sits between your business and the outside world. It filters mail, balances traffic or screens web requests. It also has its own control panel, and that panel is a door.
Barracuda Networks has disclosed two flaws in its products. The company says that if both are exploited in combination, an attacker could get around authorization checks and gain root access. Root is the highest level of control on a system.
Barracuda says an attacker needs access to the administrative interface first. That qualifier shapes the whole story. This is our argument, drawn from the company's own mitigation advice: who can reach the admin page matters as much as how well the device filters threats.
What Barracuda disclosed
Barracuda's advisory, published November 2, 2026, describes two vulnerabilities. CVE-2026-116606 is a pre-authentication authorization bypass. Barracuda gives it a CVSS score of 9.3. CVSS is a standard 0-to-10 severity scale.
CVE-2026-111560 is a command injection flaw, with a CVSS score of 8.6. Command injection means an attacker can make the device run instructions of their choosing.
The two do not affect the same products. According to Barracuda, CVE-2026-116606 affects only the ESG. The Hacker News identifies this as the Email Security Gateway. CVE-2026-111560 affects the ESG, ADC, BMA, WCC, WAF and WSG.
What the sources say about the mechanism
The sources give little technical detail. One flaw bypasses authorization. The other allows command injection. Barracuda says the combination could lead to root access.
Barracuda does not publish the exploit sequence. It does not say which flaw does what, or in what order. It does not say what either flaw allows on its own.
An analogy may help, and it is only an illustration. Think of a badge reader that checks who may enter, and a system that obeys instructions once someone is inside. Barracuda has not said the flaws map to those two steps.
One point is unresolved. Barracuda's table lists "Yes, administrative access" under authentication required for both flaws. The advisory does not explain how that fits the "pre-authentication" label. That is a fair question for Barracuda Support.
What limits the exposure
Barracuda says organizations whose admin interface is not publicly reachable from the internet are "less exposed" to this attack path. That is not the same as safe. It recommends restricting that access to trusted internal networks and applying network access controls.
Neither the advisory nor The Hacker News says whether these flaws have been exploited in attacks. Leaders should not assume either way.
The fix is simple to state. Barracuda has released patches. Devices show the latest firmware version available. A device several versions behind may need more than one update.
Barracuda says that customers who have turned off automatic patching should turn it back on so devices receive patches automatically.
What to ask your team
Start with an inventory. Ask which Barracuda products you run, and whether any are among the ESG, ADC, BMA, WCC, WAF or WSG.
Then ask three questions about each one.
First, is the firmware current, and has every patch been applied? Second, can anyone reach the admin interface from the public internet? Third, is automatic patching on, and who decided to turn it off if not?
Barracuda Support can help verify a firmware version or apply a patch. Guidance is on Barracuda Campus.
An admin page that only a few trusted internal networks can reach is a smaller target, though Barracuda calls that "less exposed", not safe. Treat the control panel's door with the same care as the building's.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: Barracuda Networks.
