Barracuda Issues Fixes for Authorization Bypass and Command Injection Across Six Products

Barracuda Networks released security updates addressing authorization-bypass and command-injection vulnerabilities across six products. CVE-2026-116606, an Email Security Gateway authorization-bypass flaw, carries a CVSS score of 9.3. CVE-2026-111560, a command-injection flaw scored 8.6, affects Email Security Gateway, Load Balancer Application Delivery Controller, Message Archiver, WAF Control Center, Web Application Firewall, and Web Security Gateway. Barracuda rates both vulnerabilities High. Although the vendor describes the first vulnerability as pre-authentication authorization bypass, its advisory lists administrative access as required for both flaws, leaving the authentication prerequisites unclear.

The Canadian Centre for Cyber Security amplified the warning through advisory AV26-1112, urging administrators to apply available updates. Barracuda recommends restricting administrative interfaces to trusted internal networks, upgrading affected appliances to the latest firmware, and verifying that all security patches have been applied. Customers should manually install patches that were not automatically deployed and enable automatic patching; devices several firmware versions behind may require multiple upgrades. The supplied advisories do not identify affected version ranges or report active exploitation.