CVE-2026-111560
Published Nov 2 by Mandiant
Vulnerabilities · 2h ago
Barracuda disclosed two vulnerabilities that can be chained to gain root access to its Email Security Gateway. The command-injection flaw also affects five other appliance lines: Load Balancer Application Delivery Controller, Message Archiver, WAF Control Center, Web Application Firewall and Web Security Gateway. The chain requires access to an affected device’s administrative interface.
On the Email Security Gateway, an authorization bypass lets a remote user reach a configuration-import function without the usual permission check. A separate flaw makes a timezone setting behave like a command. Chained, the unauthorized route can lead to command execution as root.
For organizations whose Barracuda management interfaces are reachable beyond trusted internal networks, that reachability supplies the prerequisite for the chain. Because the command-injection flaw spans six product lines, the exposure may extend beyond the Email Security Gateway; addressing that gateway alone would not settle the status of other affected appliances.
Published Nov 2 by Mandiant
Published Nov 2 by Mandiant
4 sources covering this story
Kwetsbaarheden verholpen in Barracuda Email Security Gateway
Barracuda heeft twee kwetsbaarheden vastgesteld in verschillende Barracuda-producten: een kwetsbaarheid voor het omzeilen van autorisatiecontroles (CVE-2026-116606) en een kwetsbaarheid voor command injection (CVE-2026-111560).
Barracuda’s security appliances have a security problem of their own
Chained together, an authorization bypass and a command injection vulnerability could give attackers root access to Barracuda devices.
Barracuda Flaws Could Be Chained to Bypass Authorization and Gain Root Access
Two Barracuda flaws could be chained to bypass authorization and gain root access to devices if attackers can reach their admin interfaces.
Barracuda warns of critical flaws allowing root access to devices
Cybersecurity company Barracuda Networks warned customers to patch two vulnerabilities that can let attackers run commands with root privileges.
Part of the PlainSec briefing for 2026-11-04