Barracuda patches flaws that can combine to grant root access

Barracuda Networks warned customers to patch two vulnerabilities that can combine to give attackers root access to affected appliances. CVE-2026-116606 involves an Email Security Gateway authentication weakness that permits global configuration changes. CVE-2026-111560 allows an attacker with administrator permissions to inject operating-system commands that run as root. The command-injection flaw also affects several other Barracuda products, including load balancers, message archivers and web security appliances. Barracuda released patches and advised customers to restrict administrative interfaces to trusted internal networks. Exploitation requires access to those interfaces.