Barracuda has revealed details of two vulnerabilities in its products that, if exploited together, could enable an attacker to bypass authorization controls and gain root access to a vulnerable device This article explores security gateway cve. . The vulnerabilities, a pre-authentication authorization bypass vulnerability and a command injection vulnerability, have been assigned the CVE identifiers CVE-2026-116606 (CVSS score: 9.3) and CVE-2026-111560 (CVSS score: 8.6), respectively.
Although CVE-2026-116606 is limited to the Email Security Gateway, CVE-2026-111560 impacts the following Barracuda products: Email Security Gateway, Load Balancer, Application Delivery Controller, Message Archiver, WAF Control Center, and Web Application Firewall. "Successful exploitation necessitates an attacker possessing access to the affected product's administrative interface," Barracuda explained.
"When combined, these vulnerabilities could enable an attacker to bypass authorization controls and gain root access to the device." Barracuda noted that organizations that do not expose their administrative interfaces to the internet are less susceptible to this attack path. The company urges customers to take the following steps: Restrict access to administrative interfaces to trusted internal networks and implement appropriate network access controls to minimize exposure.
Customers should ensure their systems are running the latest firmware versions and have received all security patches. If a device's firmware is outdated, customers may need to perform multiple updates.
