Barracuda Patches Flaws That Could Enable Root Access

Barracuda has released patches for two vulnerabilities that, when exploited together, could let attackers bypass authorization controls and gain root access to affected devices. The company says successful exploitation requires access to a device’s administrative interface and advises customers to install current firmware and security updates. The flaws are CVE-2026-11606, an authentication bypass in Barracuda’s Email Security Gateway (ESG), and CVE-2026-11560, a command-injection vulnerability. Barracuda rates them 9.3 and 8.6, respectively, on the Common Vulnerability Scoring System. The command-injection flaw also affects Web Security Gateway, Web Application Firewall, WAF Control Center, Load Balancer Application Delivery Controller and Message Archiver products. Barracuda says the vulnerabilities can be chained to bypass authorization and obtain root access. The command-injection issue involves a timezone configuration setting, according to Mandiant, and can allow operating-system commands to run with root privileges when abused by an administrator-level user. The authentication bypass could enable changes to the appliance’s global configuration. There is a difference in...