CVE-2026-116606

Barracuda CloudGen Firewall and Firewall Products Vulnerabilities Disclosed

Barracuda Networks has disclosed two vulnerabilities affecting CloudGen Firewall and Firewall products. A pre-authentication authorization bypass vulnerability and a command injection vulnerability, assigned CVE-2026-116606 and CVE-2026-116607 respectively, could be chained together to allow an attacker to bypass authorization controls and gain root access to susceptible devices. The CVSS score for CVE-2026-116606 is 9.3. As of the publication date, no public exploitation was confirmed, but the high severity warrants urgent attention. Barracuda has released security updates to address the flaws; affected organizations should apply the latest firmware or software updates immediately.