Critical Authorization Bypass & Command Injection in Barracuda Devices (CVE‑2026‑116606) Enables Root Access
What It Is — Barracuda has disclosed two linked flaws in its network‑security appliances. The first is a pre‑authentication authorization‑bypass vulnerability; the second is a command‑injection flaw that can be triggered after the bypass. When chained, an unauthenticated attacker can skip all privilege checks and execute arbitrary commands with root privileges on the device. The vulnerabilities are tracked as CVE‑2026‑116606 with a CVSS 9.3 (Critical). Barracuda has released patches for the affected firmware and recommends immediate upgrade.
Affected Products — Barracuda Email Security Gateway, Web Application Firewall, and other Barracuda network‑security appliances running the vulnerable firmware versions (as detailed in the vendor advisory).
Why It Matters for Trust & Control Assurance — The issue directly tests the control objective of enforcing robust authentication and authorization for privileged access. Capability focus: ACCESS_CONTROLS.
Recommended Actions —
- Deploy Barracuda’s security patches for CVE‑2026‑116606 without delay.
- Verify that all management interfaces enforce proper authentication and authorization checks.
- Enable detailed command‑execution logging and monitor for anomalous activity.
- Review and harden network segmentation to limit exposure of the affected devices.
Source: The Hacker News