CVE-2026-116606: Barracuda authorization bypass and command injection flaws grant root access

# CVE-2026-116606: Barracuda authorization bypass and command injection flaws grant root access

https://gcdradar.vercel.app/incidents/cve-2026-116606-barracuda-authorization-bypass-and-command-i · AIR-2026-1743 · live

- Lane: Patch now
- Severity: 3 (Confirmed exploitation): Critical rating (CVSS 9.3) disclosed by vendor.
- Fix status: Patched
- First reported: 2026-11-03
- AI role: No AI role
- Products: Barracuda devices
- CVE ids: CVE-2026-116606
- CVSS: 9.3

## Summary

Barracuda disclosed two vulnerabilities, including CVE-2026-116606 with a CVSS score of 9.3, that can be chained to bypass authorization controls. Successful exploitation allows attackers to gain root access to susceptible appliances.

## What to do

Apply the security updates released by Barracuda to patch the vulnerabilities.

## Latest updates

- 2026-11-10: Added to the CISA KEV catalog (exploitation confirmed) (https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-116606)
- 2026-11-10: Active exploitation in the wild confirmed for the critical ESG vulnerabilities (https://bleepingcomputer.com/news/security/hackers-exploit-barracuda-email-security-gateway-flaws-to-get-root-access)
- 2026-11-06: Researchers demonstrate the full exploit chain for the Barracuda vulnerabilities allowing unauthenticated root access (https://thehackernews.com/2026/11/experts-demonstrate-barracuda-email.html)
- 2026-11-03: Barracuda warns of critical flaws allowing root access to devices (https://bleepingcomputer.com/news/security/barracuda-warns-of-critical-flaws-allowing-root-access-to-devices)
- 2026-11-03: Barracuda Flaws Could Be Chained to Bypass Authorization and Gain Root Access (https://thehackernews.com/2026/11/barracuda-flaws-could-be-chained-to.html)

## Sources

- 2026-11-03 The Hacker News: Barracuda Flaws Could Be Chained to Bypass Authorization and Gain Root Access https://thehackernews.com/2026/11/barracuda-flaws-could-be-chained-to.html
- 2026-11-03 BleepingComputer: Barracuda warns of critical flaws allowing root access to devices https://bleepingcomputer.com/news/security/barracuda-warns-of-critical-flaws-allowing-root-access-to-devices
- 2026-11-04 SecurityWeek: Barracuda ESG Authentication Bypass Flaw Opens Path to Root https://securityweek.com/barracuda-email-security-gateway-authentication-bypass-opens-path-to-root
- 2026-11-06 The Hacker News: Experts Demonstrate Barracuda Email Security Gateway Chain Enabling Root Access Without Login https://thehackernews.com/2026/11/experts-demonstrate-barracuda-email.html
- 2026-11-10 BleepingComputer: Hackers now exploit critical Barracuda ESG flaws to gain root access https://bleepingcomputer.com/news/security/hackers-exploit-barracuda-email-security-gateway-flaws-to-get-root-access
- 2026-11-10 CISA: CVE-2026-116606: Barracuda Networks Barracuda Email Security Gateway (ESG) — Barracuda Networks Email Security Gateway (ESG) Authentication Bypass Using an Alternate Path or Channel Vulnerability https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-116606

Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.