Barracuda Flaws Could Be Chained to Bypass Authorization and Gain Root Access

Barracuda has disclosed two vulnerabilities affecting its products that can be chained together to allow attackers to bypass authorization controls and gain root access. The first is a pre-authentication authorization bypass vulnerability and the second is a command injection vulnerability. Together they have been assigned CVE-2026-116606 with a CVSS score of 9.3, indicating critical severity. If successfully exploited, an unauthenticated attacker could potentially take full control of a vulnerable Barracuda device. Organizations using affected Barracuda products are advised to apply patches or mitigations promptly.