Barracuda disclosed two vulnerabilities on November 3 that can be chained to give an attacker root access to its Email Security Gateway and other appliances. The company published details and warned customers.
Authorization Bypass and Command Injection Combine for Root
The first flaw, CVE-2026-116606, has a CVSS score of 9.3. It is a pre-authentication authorization bypass and affects the Email Security Gateway only. The second, CVE-2026-111560, carries a CVSS score of 8.6. It is a command injection flaw that affects several Barracuda products, not only the gateway.
Used together, the two bugs let an attacker bypass authorization controls and obtain root on the device. The bypass opens the door to functionality the attacker should not reach, and the command injection then supplies a way to run commands with the highest privileges.
Admin Interface Access Is the Stated Precondition
Barracuda says exploitation requires access to the administrative interface. Organizations that do not expose that interface to the internet are therefore less exposed. The company’s advice rests on this point: restrict admin interface exposure and verify that devices run current firmware.
Why Root on a Mail Gateway Is a Serious Outcome
Root access on a mail security gateway gives an attacker access to mail flow and device configuration. The gateway sits between an organization and the outside world, inspecting inbound and outbound messages, so control of it can mean visibility into messages that pass through and the ability to change how mail is handled.
The two vulnerabilities differ in scope. Only the Email Security Gateway carries the authorization bypass, but the command injection reaches several products. Administrators of other Barracuda appliances should therefore check the advisory for the product they run, because the second flaw alone may still matter on those devices.
Devices Several Versions Behind May Need Multiple Updates
Barracuda notes that devices several firmware versions behind may need more than one update to reach a fully patched state. That detail affects planning. An appliance that has gone without updates for a long time cannot always jump straight to the fixed build, and administrators should expect a sequence of upgrades rather than a single step.
What the Disclosure Does and Does Not Establish
The sources describe the vulnerabilities, the chain and the precondition, but they do not report attacks. Barracuda has not said that either flaw has been exploited, and the disclosure does not include a count of affected devices. The company’s decision to publish details and warn customers on the same day indicates it wants fixes in place before attackers study the issue.
Appliances like the Email Security Gateway have drawn attention from attackers in recent years because they sit at the network edge and run with high privileges. That history is general context rather than something specific to this case, but it explains why a pre-authentication bug with a 9.3 score draws concern even when it requires access to the admin interface.
The precondition also invites a practical question for administrators: is the admin interface reachable from anywhere it should not be? Interfaces intended for local management are sometimes exposed by accident through firewall rules or remote access settings, and a check of those settings takes little time compared with the cost of an appliance compromise.
Recommended Steps for Barracuda Administrators
Customers should verify that each device runs the latest firmware with all patches applied, and should restrict access to the administrative interface to trusted networks. Those with devices that lag several versions should plan for multiple updates and confirm the final firmware version after the process completes. Barracuda’s own warning, issued with the technical details, is the main source for what customers should apply.
