Critical · 1 source · latest 9h

Barracuda discloses two flaws that could be chained for root access

CRITICAL · VULNERABILITYBarracudaredteam/daily · 1 source

Severity: Critical
Highest CVSS: 9.3
Exploited: Not known
Sources: 1

What happened

Barracuda has disclosed a pre-authentication authorisation bypass and a command injection vulnerability that can be chained to bypass authorisation and gain root access on a susceptible device. The combined issue is tracked as CVE-2026-116606 (CVSS 9.3). The excerpt does not list affected product versions or fixes, so defenders should check the full Barracuda advisory for affected products and patched releases.

For security analysts · Written by AI from 1 source · Wrong?

What to do

Check the full Barracuda advisory to see whether your products are affected by CVE-2026-116606.
Apply any vendor fix or mitigation the advisory recommends for affected products.

Written by AI from the sources, checked against them

Read the full story at the source

Vulnerabilities

CVE-2026-116606CVSS 9.3An authentication bypass in Barracuda Email Security Gateway versions earlier than 9.4.0.030 allows an unauthenticated remote attacker to invoke a configuration-import function and restore a crafted, compatible backup archive, resulting in unauthorized modification of the appliance’s global configur

Full story timeline · 2 updates

Mon 2 November13:17CVE-2026-116606 published, CVSS 9.3NVD
Tue 3 November15:59Barracuda Flaws Could Be Chained to Bypass Authorization and Gain Root AccessThe Hacker News

Who reported · 1 outlet

The Hacker News

Who and what is in it

Companies

Barracuda