Pre-Authentication Authorization Bypass and Command Injection Vulnerabilities in Certain Barracuda Products - Updates Available

Barracuda has identified two vulnerabilities affecting certain Barracuda products: a pre-authentication authorization bypass vulnerability and a command injection vulnerability. The vulnerabilities have been assigned CVE-2026-116606 and CVE-2026-111560, respectively.

Successful exploitation requires an attacker to have access to the administrative interface of an affected product. If exploited in combination, these vulnerabilities could allow an attacker to bypass authorization controls and obtain root access to the device.

Barracuda immediately initiated a comprehensive remediation process and released security patches for affected products. We have identified exploitation activity affecting a small number of organizations.

Customers should review the affected products and remediation guidance below, ensure their systems are running the latest firmware version, and have all security patches applied.

Affected Products and Remediation The following Barracuda products are affected by CVE-2026-116606 and/or CVE-2026-111560.

Administrative Access - Organizations whose administrative interfaces are not publicly accessible from the internet are less exposed to this attack path. Barracuda recommends restricting access to administrative interfaces to trusted internal networks and using appropriate network access controls to limit exposure.

Firmware - Customers using these products should verify that their systems are running the latest firmware versions and have received all security patches. The device will show the latest firmware version available.

If firmware on a device is multiple versions out of date, customers may need to perform more than one update. Contact Barracuda Support for assistance.

Patches - If a patch has not been automatically applied, customers should manually apply the appropriate patch as soon as possible. If customers have turned off automatic patching, Barracuda recommends setting devices to automatically receive patches.

Guidance on how to manually apply the patch or update firmware can be found on Barracuda Campus. Customers who require assistance verifying their firmware version or applying the appropriate security patch should contact Barracuda Support at support@barracuda.com.

Security Advisory Information

CVE: CVE-2026-116606Vulnerability Type: Pre-Authentication Authorization BypassAffected Product: ESG Severity: High CVSS Score: 9.3 Authentication Required: No (Administrative UI Access Required) Remediation: Upgrade to the latest firmware version Advisory Published: November 2, 2026 Advisory Updated: November 2, 2026

CVE: CVE-2026-111560 Vulnerability Type: Command Injection Affected Products: ESG, ADC, BMA, WCC, WAF, WSG Severity: High CVSS Score: 8.6 Authentication Required: Yes (Administrative Access) Remediation: Upgrade to the latest firmware versions Advisory Published: November 2, 2026 Advisory Updated: November 2, 2026.