Barracuda has disclosed the details of two critical security vulnerabilities affecting its products that, when chained together, could enable an attacker to bypass authorization controls and gain root access to a susceptible device. The disclosure highlights a significant security risk for organizations relying on Barracuda’s infrastructure solutions.
The security flaws consist of a pre-authentication authorization bypass vulnerability and a command injection vulnerability. According to the company, these two distinct issues can be exploited in sequence to escalate privileges and compromise the core system.
The vulnerabilities have been assigned the Common Vulnerabilities and Exposures identifier CVE-2026-116606. The pre-authentication authorization bypass component carries a Common Vulnerability Scoring System (CVSS) score of 9.3, indicating a high level of severity and potential impact on affected systems.
By chaining the authorization bypass with the command injection flaw, attackers could potentially execute unauthorized commands with root-level privileges. This combination allows for a complete bypass of standard security measures designed to prevent unauthorized access to administrative functions.
Barracuda’s disclosure of these details is intended to alert customers and security professionals to the specific risks posed by these vulnerabilities. The company has provided the technical identifiers to facilitate the identification and mitigation of the flaws within affected environments.
<small>Source: The Hacker News — read the original story there.</small>
