Skip to content
~/pwn.watch_

Get notified

Get an email when a new major security incident drops. No spam, unsubscribe any time.

Only used for pwn.watch incident emails. Protected by Cloudflare Turnstile.

Become a sponsor

One slot: pwn.watch, gifs.so, flavors.design, kitze.io, every kitze repo, and an X shout-out.

YearlyBest value · save 44%$999/year$83.25/mo, billed yearly. Save $789 vs monthly (5+ months free).Monthly$149/monthBilled monthly. Cancel anytime.

Secure checkout on Polar. Right after paying you set up your ad on kitze.io.

← Live incidents
LivePatchedPatch now

Barracuda fixes pre-auth authorization bypass and command injection that can yield root

Barracuda ESG, ADC, BMA, WCC, WAF, WSG

Brought to you byTinkerer Club

The private club for people who own their servers, run their own AI, and pay $0/month for software.

Barracuda Networks disclosed two flaws affecting several appliances: CVE-2026-116606, a pre-authentication authorization bypass in Email Security Gateway, and CVE-2026-111560, a command-injection bug affecting ESG, Load Balancer ADC, Message Archiver, WAF Control Center, Web Application Firewall and Web Security Gateway. Barracuda says successful exploitation needs access to the administrative interface; chained, the bugs can bypass authorization and obtain root. Patches are available per product via Barracuda Campus articles. Restrict admin interfaces to trusted networks and apply the latest firmware immediately. Coverage appeared Nov 3 2026 (BleepingComputer, The Hacker News, CCB Belgium).

Why this severity: Pre-auth authorization bypass plus command injection; chained to root on admin-interface exposure

Started
Nov 3, 2026
CVEs
CVE-2026-116606CVE-2026-111560

Follow this incident

Affected

  • Barracuda Email Security Gateway (CVE-2026-116606 and CVE-2026-111560)
  • Barracuda ADC, Message Archiver, WAF Control Center, WAF, Web Security Gateway (CVE-2026-111560)

Fixed in

  • Latest Barracuda firmware / security patches per Campus product articles

Timeline1

  1. Barracuda publishes Campus guidance for CVE-2026-116606 and CVE-2026-111560; BleepingComputer and The Hacker News report that chaining can yield root when the admin interface is reachable.

Advisories2

News & write-ups1

Get an email when a new major security incident drops. No spam, unsubscribe any time.

Sponsored

Buy sponsor slot · $149/mo