Covered by 2 outlets — first reported by The Hacker News, Nov 3, 15:59 UTC
Barracuda Flaws Could Be Chained to Bypass Authorization and Gain Root Access
In brief
Barracuda has disclosed details of two vulnerabilities affecting its products that, if chained together, could allow an attacker to bypass authorization controls and gain root access to a susceptible device. The vulnerabilities, a pre-authentication authorization bypass vulnerability and a command injection vulnerability, have been assigned the CVE identifiers CVE-2026-116606 (CVSS score: 9.3)
From The Hacker News's coverage.
Continue reading
2 outlets, in the order they reported it.
The Hacker NewsFirst report
Barracuda Flaws Could Be Chained to Bypass Authorization and Gain Root Access
Barracuda has disclosed details of two vulnerabilities affecting its products that, if chained together, could allow an attacker to bypass authorization controls and gain root access to a susceptible device.
SecurityWeek
Barracuda ESG Authentication Bypass Flaw Opens Path to Root
An authentication bypass and a command injection flaw can be chained for root access on Barracuda’s Email Security Gateway appliances.
Explained
The technology and terms in this story. Learn more
- WeaknessCommand injectionGetting an application to run operating-system commands built from attacker input.
- ConceptCVSS · Common Vulnerability Scoring SystemA 0–10 score for how severe a vulnerability is in theory.
- WeaknessAuthentication bypassA flaw that lets someone in without valid credentials.
- ConceptCVE · Common Vulnerabilities and ExposuresThe public ID system for vulnerabilities, such as CVE-2026-12345, so everyone means the same bug.
Why it was possible
The weaknesses behind this story's CVEs, from each CVE Record.