Barracuda Flaws Could Be Chained to Bypass Authorization and Gain Root Access

Barracuda disclosed two vulnerabilities in its products that can be chained to bypass authorization and gain root access. The first is a pre-authentication authorization bypass vulnerability (CVE-2026-116606), and the second is a command injection vulnerability (CVE-2026-111560). When exploited together, these flaws allow an attacker to obtain root access to affected devices. Barracuda advises customers to restrict administrative interface access and apply the latest firmware updates to mitigate the risk.

AI-extracted · verify before operational use