Barracuda Flaws Chain to Root Access via Pre-Auth Bypass

Tue, 03 Nov 2026 18:24:39 +0000

Engineer — Act: A public PoC is available for this critical (CVSS 9.3) pre-auth bypass + command injection chain yielding root on Barracuda appliances; apply Barracuda’s patch immediately and confirm no devices were compromised before patching.
SOC/IR — Act: With a public PoC in hand for a pre-auth root chain on a network edge appliance, assume-breach posture is warranted: sweep Barracuda device logs for anomalous admin activity or unexpected outbound connections since the PoC’s publication date.
Leader — Plan: Confirm whether the organization deploys any Barracuda appliances and verify engineering has this patch on an accelerated timeline; Barracuda edge devices have been high-profile breach vectors before, and a public PoC raises near-term risk materially.
Signals: CVE-2026-116606 — CISA KEV: not listed, EPSS 0.01, public PoC on GitHub

Barracuda on CuraSec