Barracuda Vulnerabilities Enable Chained Attacks for Root Access Bypass

Barracuda has disclosed two vulnerabilities, CVE-2026-116606, that could be chained to bypass authorization controls and achieve root access. The flaws include a pre-authentication authorization bypass and a command injection vulnerability with a CVSS score of 9.3.

Barracuda has disclosed details of two vulnerabilities affecting its products that, if chained together, could allow an attacker to bypass authorization controls and gain root access to a susceptible device.

The vulnerabilities, a pre-authentication authorization bypass vulnerability and a command injection vulnerability, have been assigned the CVE identifiers CVE-2026-116606 (CVSS score: 9.3)

Read original article