Barracuda flaws make reachable admin interfaces a root path
Barracuda disclosed two vulnerabilities that can be chained to gain root access to its Email Security Gateway. The command-injection flaw also affects five other appliance lines: Load Balancer Application Delivery Controller, Message Archiver, WAF Control Center, Web Application Firewall and Web Security Gateway. The chain requires access to an affected device’s administrative interface.
On the Email Security Gateway, an authorization bypass lets a remote user reach a configuration-import function without the usual permission check. A separate flaw makes a timezone setting behave like a command. Chained, the unauthorized route can lead to command execution as root.
For organizations whose Barracuda management interfaces are reachable beyond trusted internal networks, that reachability supplies the prerequisite for the chain. Because the command-injection flaw spans six product lines, the exposure may extend beyond the Email Security Gateway; addressing that gateway alone would not settle the status of other affected appliances.
Kwetsbaarheden verholpen in Barracuda Email Security Gateway
Barracuda heeft twee kwetsbaarheden vastgesteld in verschillende Barracuda-producten: een kwetsbaarheid voor het omzeilen van autorisatiecontroles (CVE-2026-116606) en een kwetsbaarheid voor command injection (CVE-2026-111560).