Barracuda appliances: auth bypass and command injection chain to root (CVE-2026-116606, CVE-2026-111560)
Severity: critical · Patch status: patched · Since 2026-11-02 · CVE-2026-111560, CVE-2026-116606
Barracuda's advisory of 2 November 2026 covers two flaws that, used together, let an attacker bypass authorization and reach root on affected appliances. CVE-2026-116606 is an authentication bypass in Email Security Gateway (ESG) firmware before 9.4.0.030 that lets an unauthenticated network attacker restore a crafted backup through the configuration-import function and change the global configuration. CVE-2026-111560 is an OS command injection through the timezone field that runs as root and needs administrator access. Six products are in scope: ESG, Load Balancer ADC, Message Archiver, WAF Control Center, Web Application Firewall and Web Security Gateway. Barracuda has released patches for all of them. Barracuda's own advisory says exploitation requires access to an affected product's administrative interface and advises restricting that interface to trusted networks; Mandiant's advisory for CVE-2026-116606 instead describes exposure to unauthenticated remote attackers and scores it CVSS 4.0 9.3. No source reports exploitation. CVE-2023-2868 and CVE-2023-7102 are 2023 ESG flaws that BleepingComputer mentions as background (UNC4841); they are not part of this advisory.
What to do
- Apply the vendor patches now: ESG BNSF-40425 (9.4.017+) or BNSF-40430 (<9.4.017); BNADC-16586 for Load Balancer ADC and WAF; BNMA-32468 for BMA; BNWF-60060 for WCC; BNYF-24789 for WSG
- Restrict administrative interfaces to trusted internal networks with network access controls, since Barracuda's advisory makes admin-interface reach a precondition and Mandiant calls CVE-2026-116606 unauthenticated
- Confirm each device runs the latest firmware with all security patches applied (Barracuda Campus has the manual steps; Barracuda Support handles version checks)
- Check appliances for unauthorized configuration changes, unexpected restored backups and unexpected admin activity
Fixed versions
- ESG 9.4.017+ (BNSF-40425)
- ESG <9.4.017 via patch BNSF-40430
- Load Balancer ADC and WAF (BNADC-16586)
- Message Archiver (BNMA-32468)
- WAF Control Center (BNWF-60060)
- Web Security Gateway (BNYF-24789)
Sources
All live incidents on Threat Watch
