# Barracuda fixes pre-auth authorization bypass and command injection that can yield root · pwn.watch

> Barracuda Networks disclosed two flaws affecting several appliances: CVE-2026-116606, a pre-authentication authorization bypass in Email Security Gateway, and CVE-2026-111560, a command-injection bug affecting ESG, Load Balancer ADC, Message Archiver, WAF Control Center, Web Application Firewall and Web Security Gateway. Barracuda says successful exploitation needs access to the administrative interface; chained, the bugs can bypass authorization and obtain root. Patches are available per product via Barracuda Campus articles. Restrict admin interfaces to trusted networks and apply the latest firmware immediately. Coverage appeared Nov 3 2026 (BleepingComputer, The Hacker News, CCB Belgium).

Page: https://pwn.watch/i/barracuda-authorization-bypass-command-injection-cve-2026-116606 · generated 2026-11-04T14:14:08.250Z

## Status
- Severity: critical · status: live · patch: patched
- Product: Barracuda ESG, ADC, BMA, WCC, WAF, WSG
- Started: 2026-11-03
- CVEs: CVE-2026-116606, CVE-2026-111560
- Affected: Barracuda Email Security Gateway (CVE-2026-116606 and CVE-2026-111560); Barracuda ADC, Message Archiver, WAF Control Center, WAF, Web Security Gateway (CVE-2026-111560)
- Fixed in: Latest Barracuda firmware / security patches per Campus product articles

## Follow this incident
- RSS (one item per update): https://pwn.watch/i/barracuda-authorization-bypass-command-injection-cve-2026-116606/feed.xml
- JSON Feed: https://pwn.watch/i/barracuda-authorization-bypass-command-injection-cve-2026-116606/feed.json
- Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/barracuda-authorization-bypass-command-injection-cve-2026-116606.json
- This file: https://pwn.watch/i/barracuda-authorization-bypass-command-injection-cve-2026-116606/llms.txt

## Updates (newest first)
- 2026-11-03: Barracuda publishes Campus guidance for CVE-2026-116606 and CVE-2026-111560; BleepingComputer and The Hacker News report that chaining can yield root when the admin interface is reachable. (https://documentation.campus.barracuda.com/wiki/spaces/CP/pages/960921759/Security+Updates+Available+for+Certain+Barracuda+Products)

## Fix brief
# Security brief: Barracuda fixes pre-auth authorization bypass and command injection that can yield root

Source: https://pwn.watch/i/barracuda-authorization-bypass-command-injection-cve-2026-116606 · status: live · severity: critical · updated Nov 4, 2026, 11:40 UTC

## Patch status
**PATCHED: fixed releases exist. Upgrade to a fixed version.**

## What it is
Barracuda Networks disclosed two flaws affecting several appliances: CVE-2026-116606, a pre-authentication authorization bypass in Email Security Gateway, and CVE-2026-111560, a command-injection bug affecting ESG, Load Balancer ADC, Message Archiver, WAF Control Center, Web Application Firewall and Web Security Gateway. Barracuda says successful exploitation needs access to the administrative interface; chained, the bugs can bypass authorization and obtain root. Patches are available per product via Barracuda Campus articles. Restrict admin interfaces to trusted networks and apply the latest firmware immediately. Coverage appeared Nov 3 2026 (BleepingComputer, The Hacker News, CCB Belgium).

Severity detail: Pre-auth authorization bypass plus command injection; chained to root on admin-interface exposure

- Product: Barracuda ESG, ADC, BMA, WCC, WAF, WSG
- CVE / advisory ids: CVE-2026-116606, CVE-2026-111560

## Affected versions
- Barracuda Email Security Gateway (CVE-2026-116606 and CVE-2026-111560)
- Barracuda ADC, Message Archiver, WAF Control Center, WAF, Web Security Gateway (CVE-2026-111560)

## Check whether you're affected
No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above.

## Fix
Upgrade to one of these fixed versions (or later on the same branch):
- Latest Barracuda firmware / security patches per Campus product articles

After upgrading, re-run the checks above and redeploy/restart the affected services.

## Specific notes
Apply the product-specific Barracuda Campus patch for ESG, ADC, BMA, WCC, WAF or WSG. Confirm firmware is current. Keep administrative interfaces off the public internet.

## Latest updates
- Nov 3, 2026: Barracuda publishes Campus guidance for CVE-2026-116606 and CVE-2026-111560; BleepingComputer and The Hacker News report that chaining can yield root when the admin interface is reachable.

## Advisories
- [Security Updates Available for Certain Barracuda Products](https://documentation.campus.barracuda.com/wiki/spaces/CP/pages/960921759/Security+Updates+Available+for+Certain+Barracuda+Products) (Barracuda Networks)
- [Warning: Authorization bypass and command injection in Barracuda products](https://ccb.belgium.be/advisories/warning-authorization-bypass-and-command-injection-barracuda-email-security-gateway-and) (CCB Belgium)

## Write-ups & news
- [Barracuda warns of critical flaws allowing root access to devices](https://www.bleepingcomputer.com/news/security/barracuda-warns-of-critical-flaws-allowing-root-access-to-devices/)

---
Machine-readable: https://pwn.watch/i/barracuda-authorization-bypass-command-injection-cve-2026-116606.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.