Barracuda’s security appliances have a security problem of their own

Publisher excerpt From CSO Online

Barracuda, which offers a wide variety of cybersecurity devices, has been bitten by a bug itself. The company has disclosed two critical and high-severity vulnerabilities that, if chained together, could allow threat actors to bypass authorization controls and gain root access to devices. They consist of a pre-authentication authorization bypass vulnerability, tracked as CVE-2026-116606 (rated a critical 9.3 severity on the common vulnerability scoring system), and a command injection vulnerability tracked as CVE-2026-111560 (rated an 8.6 high-severity on CVSS). Attackers need to have access to the admin interface of a susceptible device to successfully exploit these vulnerabilities. Barracuda has released security patches, which it advises customers to apply immediately. The vulnerabilities impact numerous popular Barracuda products Root access on an email gateway puts the attacker in the place that every inbound and outbound message passes, said Frank Dickson of Dickson Research. It may also expose the credentials and connections the gateway uses to reach the mail server and directory. “Those are the keys to the kingdom, if you will,” he said. CVE-2026-116606 and CVE-2026-111560 both impact Barracuda’s Email Security Gateway (ESG), but CVE-2026-111560 also impacts its Web Security Gateway (WSG), Web Application Firewall (WAF), WAF Control Center (WCC), Load Balancer Application Delivery Controller (ADC), and Message Archiver (BMA), the company said. Customers using these products should verify that their systems are running the latest firmware versions and have received all security patches, it advised. The device will show the latest firmware version available; if a device’s firmware is multiple versions out of date, users may need to perform several updates. Enterprises whose appliances’ admin interfaces are not publicly accessible from the web are less exposed, Barracuda said; the company advised restricting access to these interfaces to trusted internal networks and applying appropriate network access controls to limit exposure. “The biggest concern is how these two vulnerabilities could chain together,” said Jon Nelson, principal advisory director at Infotech, noting that an attacker who can bypass authentication and then exploit command injection could move from accessing an exposed appliance to executing commands on it. “Assessing each vulnerability in isolation can understate the risk,” he said. Dickson added that security leaders should read the advisory closely, as it calls one flaw “pre-authentication,” then lists “Authentication Required: Yes, administrative access.” “Both cannot be true in the usual sense,” he pointed out. Likely access here means being able to reach the admin interface over the network, without a password. “If your admin interface faces the internet, that condition is already met,” Dickson said. The advisory also labels a 9.3 severity rating as “high,” when 9.0 and above is actually “critical” on the…

Excerpt only, shown with attribution. This content belongs to the original publisher and has not been independently verified by CyberSecurity.pk.