Critical · 1 source · latest 8h

Barracuda discloses two flaws that could be chained for root access

CRITICAL · VULNERABILITYBarracudaredteam/daily · 1 source

Severity: Critical
Highest CVSS: 9.3
Exploited: Not known
Sources: 1

What happened

Barracuda has disclosed a pre-authentication authorisation bypass and a command injection flaw affecting its products. Chained together, they could let an attacker bypass authorisation and gain root access to a susceptible device, and the article is tagged CVE-2026-116606 with a CVSS score of 9.3.

For IT people · Written by AI from 1 source · Wrong?

What to do

Check the full Barracuda advisory to see whether your products are affected by CVE-2026-116606.
Apply any vendor fix or mitigation the advisory recommends for affected products.

Written by AI from the sources, checked against them

Read the full story at the source

Vulnerabilities

CVE-2026-116606CVSS 9.3An authentication bypass in Barracuda Email Security Gateway versions earlier than 9.4.0.030 allows an unauthenticated remote attacker to invoke a configuration-import function and restore a crafted, compatible backup archive, resulting in unauthorized modification of the appliance’s global configur

Full story timeline · 2 updates

Mon 2 November13:17CVE-2026-116606 published, CVSS 9.3NVD
Tue 3 November15:59Barracuda Flaws Could Be Chained to Bypass Authorization and Gain Root AccessThe Hacker News

Who reported · 1 outlet

The Hacker News

Who and what is in it

Companies

Barracuda