Barracuda fixes pre-auth authorization bypass and command injection that can yield root ยท updates https://pwn.watch/i/barracuda-authorization-bypass-command-injection-cve-2026-116606 Barracuda Networks disclosed two flaws affecting several appliances: CVE-2026-116606, a pre-authentication authorization bypass in Email Security Gateway, and CVE-2026-111560, a command-injection bug affecting ESG, Load Balancer ADC, Message Archiver, WAF Control Center, Web Application Firewall and Web Security Gateway. Barracuda says successful exploitation needs access to the administrative interface; chained, the bugs can bypass authorization and obtain root. Patches are available per product via Barracuda Campus articles. Restrict admin interfaces to trusted networks and apply the latest firmware immediately. Coverage appeared Nov 3 2026 (BleepingComputer, The Hacker News, CCB Belgium). en Tue, 03 Nov 2026 00:00:00 GMT Barracuda fixes pre-auth authorization bypass and command injection that can yield root: Barracuda publishes Campus guidance for CVE-2026-116606 and CVE-2026-111560; BleepingComputer and The Hacker News report that chaining can yield root when the admin interface is reachable. https://pwn.watch/i/barracuda-authorization-bypass-command-injection-cve-2026-116606 https://pwn.watch/i/barracuda-authorization-bypass-command-injection-cve-2026-116606#2026-11-03-919a9299 Tue, 03 Nov 2026 00:00:00 GMT critical <p><a href="https://documentation.campus.barracuda.com/wiki/spaces/CP/pages/960921759/Security+Updates+Available+for+Certain+Barracuda+Products">Source</a></p>