Barracuda Flaws Could Be Chained to Bypass Authorization and Gain Root Access Ravie LakshmananNov 03, 2026Vulnerability / Network Security Barracuda has disclosed details of two vulnerabilities affecting its products that, if chained together, could allow an attacker to bypass authorization controls and gain root access to a susceptible device. The vulnerabilities, a pre-authentication authorization bypass vulnerability and a command injection vulnerability, have been assigned the CVE identifiers CVE-2026-116606 (CVSS score: 9.3) and CVE-2026-111560 (CVSS score: 8.6), respectively. While CVE-2026-116606 only affects Email Security Gateway, CVE-2026-111560 impacts the following Barracuda products - Load Balancer Application Delivery Controller "Successful exploitation requires an attacker to have access to the administrative interface of an affected product," Barracuda said. "If exploited in combination, these vulnerabilities could allow an attacker to bypass authorization controls and obtain root access to the device." Barracuda said that organizations that do not expose their administrative interfaces to the internet are less vulnerable to the attack path, urging customers to follow the steps below - Restrict access to administrative interfaces to trusted internal networks Use appropriate network access controls to limit exposure "Customers using these products should verify that their systems are running the latest firmware versions and have received all security patches," it added. "If firmware on a device is multiple versions out of date, customers may need to perform more than one update." Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post. email security, network security, Vulnerability, Web Security GoAhead TLS Flaws Allow Revoked Client Certificates and Enable Session Decryption Linux Kernel TCP Flaw With 9.8 CVSS Score Affects Ubuntu, Red Hat and Other Distributions Attackers Exploit PHP2Shell Flaws in Internet-Exposed Palo Alto Networks Management Interfaces ThreatsDay: Critical Firewall Flaws, Banking Trojans Rented, Weaponized PDF, Token Theft + 26 More Stories PHP Issues Second Windows Security Update in Five Days to Fix Brotli Code Execution Flaw Cisco Patches Actively Exploited ASA and FTD VPN Flaw That Can Crash Firewalls Official Claude Code Extension on Cursor Marketplace Trojanized with Persistent SSH Backdoor Chinese Hackers Use AI-Powered ARTEX to Target Over 200 Organizations Worldwide Why Urgent Security Fixes Aren't Fixed. Observe, Prove, Act, Confirm Gets Them Moving Microsoft 365 Token-Replay Attacks Compromise 97 Accounts at 79 Organizations PHP2Shell Attack Roots 25 Servers, Breaches U.S. Government-Affiliated Network TeamViewer Flaw Lets Remote Computers Attack Users Who Connect to Control Them The Rise of the Threat Operator: How AI Will Redefine Security Operations and Careers Critical 16-Year-Old UEFI Flaw Can Run Code Before Secure Boot on Network-Booting Servers American Organizations Under Attack: Skyw4lker Device Code Phishing Campaign Exposed AI-Generated Fake Login Pages Are Making Account Takeovers Easier Microsoft Authenticator Flaw Let Permissionless Android Apps Steal Work Account Tokens Unpatched Tailscale SSH Flaws Could Let a Hacked Device Reach Root on Other Servers Binance Suffers Security Breach Affecting $6.3 Billion in Assets, Nearly $3 Billion Frozen CyberStrikeAI Uses 44 AI Agents to Automate Hacking Operations Against Japan Targets Brotli Decoder Flaw Behind Node.js RCE Also Affects Bun, Python and Other Widely Used Software Leaked LiteLLM Master Key Let Attackers Steal GitHub Tokens and Hijack Release Pipeline China-Linked Hackers Exploited VMware ESX Zero-Day to Reduce Audit Trail Visibility Anthropic's Unreleased AI Model Chains Flaws Into Working Chrome, Safari, Windows and Linux Exploits See How Bitdefender GravityZone Identifies Shadow AI and Prioritizes Endpoint Risks Beyond CVE Scanning: Book a Demo of Continuous AI-Powered Web Pentesting Detect Lateral Movement and Evasive Attacks With Corelight's Open NDR Platform Assess Your Organization's AI Code Sprawl Exposure With This Practical Guide Your SOC Has an Identity Blind Spot. Here's How to Fix It Learn how to close critical identity visibility gaps in your SOC, detect hidden threats, and accelerate incident response across human, machine, and AI identities. Register Free Today Roadmap for AI-Ready Security Operations Evaluate Attack Surface Visibility With an AI Threat Readiness Framework Learn how to assess AI threat readiness, strengthen attack surface visibility, and prepare security operations for emerging threats in this practical webinar. Accelerate Incident Response: 95% Faster Containment Cut containment time from 48 hours to 3. Read the Orchid IR case study. Governance Sets the Ceiling on Your AI Security Program See the five moves that raise a Stage 2 Govern score to a defensible Stage 3. 11 Real Stories: How Identity Exposure Unlocks Active Attack Paths Map cross-domain privilege escalation to sever breach routes at key choke points. BeyondTrust an 8X Gartner® Magic Quadrant™ Leader for PAM Gain clarity on the PAM market and understand why BeyondTrust is again a Leader. The MSP Margin Math Nobody's Doing: Your Next Technician Might Already be on Payroll PEDM vs. Standing Elevated Privileges: Control Access Without Flooding the Helpdesk Your Backup Isn't Ransomware-Proof Just Because It Exists Why Root and Jailbreak Detection Alone Cannot Guarantee Mobile App Security