Barracuda has disclosed details of two vulnerabilities in its products. According to the report, if an attacker chains the two flaws together, they could bypass authorization controls and gain root access to a susceptible device.
The two flaws are a pre-authentication authorization bypass vulnerability and a command injection vulnerability. The report gives one identifier, CVE-2026-116606, which carries a CVSS score of 9.3. The source text cuts off before it names the affected products or describes exploit status, so those details are not available in this report.
Source: The Hacker News