Barracuda has patched two bugs that, used together, take an Email Security Gateway from no login at all to a root shell. The first lets an outsider who can reach the gateway’s admin interface restore a crafted backup and rewrite the appliance’s settings. The second turns a booby-trapped timezone setting into commands that run as root.
Get the CyberExperts Daily Brief: the day's top security news in 5 minutes. Free.
The second bug also sits in five other Barracuda appliance lines, from the web application firewall to the message archiver. Barracuda has not said the bugs are being exploited. It does want every customer to confirm the patch actually landed.
On a Barracuda email gateway, two bugs together go from no login to root. The fix is a patch you should confirm, not assume.
Don’t Miss the Policy Changes That Affect Security Decisions
Get the key CISA actions, new regulations, guidance, and risk shifts in a quick daily brief.
By subscribing you agree to our Privacy Policy.
Free. Weekday mornings. 5 minutes or less.
Two Barracuda bugs chain from no login to root
Barracuda published the advisory on November 2. CVE-2026-116606 (CVSS 4.0 score 9.3) affects only the Email Security Gateway (ESG) before 9.4.0.030. According to its CVE record, an unauthenticated remote attacker can call a configuration-import function and restore a crafted backup archive, which changes the appliance’s global configuration.
CVE-2026-111560 (8.6) is a command injection in the timezone configuration field, in code that several Barracuda products share. An administrator, or anyone who has become one through the first bug, can plant shell commands there that later run as root. Mandiant published advisories for both bugs the same day.
- Email Security Gateway: both bugs. Patch BNSF-40425 for 9.4.017 and later, BNSF-40430 for older firmware.
- Load Balancer ADC and Web Application Firewall: CVE-2026-111560, patch BNADC-16586.
- Message Archiver: patch BNMA-32468. WAF Control Center: BNWF-60060. Web Security Gateway: BNYF-24789.
Email gateways with a reachable admin page come first
Barracuda says the attack needs access to the administrative interface, so gateways whose admin page is reachable from the internet carry the most risk. The CVE record for the gateway bug lists no credentials as a requirement, only network reach to that page.
ESG has been a target before. In 2023 a group tracked as UNC4841 exploited two ESG zero-days, and Barracuda later said one of them, CVE-2023-2868, had been used for at least seven months, BleepingComputer recalls. Barracuda has more than 200,000 customers.
Confirm the patch on every appliance, then lock down the admin page
- On each appliance, open the web interface and check the firmware and patch status. Barracuda says patches usually apply on their own, so look hardest at any box where automatic patching was switched off.
- Apply the patch for your product from the table above if it is missing, using the steps on Barracuda Campus. Devices several firmware versions behind may need more than one update.
- Limit the admin interface to trusted internal networks or a management VPN, as Barracuda advises. Remove any firewall rule that publishes it to the internet.
- Turn automatic patching back on where it was disabled.
Forward this
For whoever runs our email gateway, web filter or load balancer: Barracuda fixed two bugs that together can give an outsider root on its Email Security Gateway, and one of them also affects its WAF, load balancer, archiver and web gateway. Can we confirm every Barracuda box has the November 2 patch and that its admin page is not reachable from the internet?
Details
- CVE-2026-116606: authentication bypass (CWE-288), ESG before 9.4.0.030. Unauthenticated restore of a crafted backup through a configuration-import function. CVSS 4.0 9.3 (AV:N/AC:L/PR:N). Mandiant MNDT-2026-0042.
- CVE-2026-111560: OS command injection (CWE-78) in the timezone field, run as root. Affected per the CVE record: ESG up to 9.4.0.27, Load Balancer ADC up to 6.4.0, WAF up to 11.0.1, Web Security Gateway up to 16.1.100.100, Message Archiver up to 5.5.4.0, WAF Control Center up to 2.2.1. CVSS 4.0 8.6 (PR:H). Mandiant MNDT-2026-0041.
- Exploitation: Barracuda’s advisory, published and last updated November 2, does not report attacks. Neither CVE is on CISA’s KEV list.
Hunt / verify
- From outside your network, test whether each Barracuda admin page answers. Anything that loads from the internet goes to the top of the patch list.
- In the appliance logs, look for configuration restores or backup imports nobody on your team ran, and for odd timezone values in system settings.
- Compare the admin accounts and global settings on each ESG against your last known-good backup.
Source: Barracuda advisory; Barracuda Campus patch steps
Sources
- Barracuda Trust Center: Pre-Authentication Authorization Bypass and Command Injection Vulnerabilities in Certain Barracuda Products (November 2, 2026)
- Barracuda Campus: Security Updates Available for Certain Barracuda Products
- Mandiant MNDT-2026-0042: CVE-2026-116606
- Mandiant MNDT-2026-0041: CVE-2026-111560
- BleepingComputer: Barracuda warns of critical flaws allowing root access to devices
- The Hacker News: Barracuda Flaws Could Be Chained to Bypass Authorization and Gain Root Access
- CVE.org: CVE-2026-116606
Start your morning with the signal that matters.
Get the biggest cybersecurity developments, why they matter, and where to go deeper on CyberExperts.
By subscribing you agree to our Privacy Policy.
Free. Weekdays. Built for operators.
