Barracuda CloudGen Firewall and Firewall Products Vulnerabilities Disclosed

Barracuda Networks has disclosed details of two vulnerabilities affecting its CloudGen Firewall and Firewall product lines. According to the advisory, a pre-authentication authorization bypass vulnerability and a command injection vulnerability can be chained together to allow an attacker to bypass authorization controls and gain root access to a susceptible device.

The vulnerabilities have been assigned the CVE identifiers CVE-2026-116606 and CVE-2026-116607. CVE-2026-116606 carries a CVSS score of 9.3, reflecting the high severity of the authorization bypass flaw. The second vulnerability, CVE-2026-116607, is described as a command injection flaw.

Successful exploitation of the chained vulnerabilities could lead to full system compromise with root-level privileges, allowing an attacker to execute arbitrary commands and potentially take control of the affected network security appliance.

Barracuda has released security updates to address these vulnerabilities. The company recommends that affected organizations apply the latest firmware or software updates immediately. As of the publication date, no public exploitation was confirmed, though the high CVSS score indicates significant risk.

The affected products include Barracuda CloudGen Firewall and Barracuda Firewall.