Barracuda vulnerabilities allow attackers to bypass authorization and gain root access

What happened

Two vulnerabilities in Barracuda products can be chained to take root control of an Email Security Gateway (ESG) appliance. The first, CVE-2026-116606 (CVSS 9.3), is a pre-authentication authorization bypass that affects only the ESG. Mandiant's advisory says it allows an unauthenticated remote attacker to invoke a configuration-import function and restore a crafted, compatible backup archive, resulting in unauthorized modification of the appliance's global configuration.

The second, CVE-2026-111560 (CVSS 8.6), is a command injection vulnerability. Barracuda says that when the two flaws are combined, an attacker could bypass authorization controls and obtain root access to the device. The command injection flaw is not limited to the ESG: it also affects the Load Balancer Application Delivery Controller (ADC), Message Archiver (BMA), WAF Control Center (WCC), Web Application Firewall (WAF) and Web Security Gateway (WSG). On those five products only CVE-2026-111560 applies, so the full two-flaw chain described in the advisory is an ESG issue. Barracuda published its advisory on November 2, 2026, with patches for every affected product.

Why it matters

The impact on the ESG is severe because a successful chain ends in root access to the appliance. The attack requires access to the administrative interface, and Barracuda says organizations whose administrative interfaces are not publicly accessible from the internet are less exposed. Appliances with internet-facing management interfaces, or with automatic patching turned off and the patch never applied by hand, are the ones most likely to still be open to this chain. Owners of the other five products still face a command injection flaw that requires administrative access and should patch as well.

Who is affected

• Barracuda Email Security Gateway (ESG) (both CVE-2026-116606 and CVE-2026-111560; Mandiant lists ESG versions earlier than 9.4.0.030 as affected by CVE-2026-116606)
• Barracuda Load Balancer Application Delivery Controller (ADC) (CVE-2026-111560 only)
• Barracuda Message Archiver (BMA) (CVE-2026-111560 only)
• Barracuda WAF Control Center (WCC) (CVE-2026-111560 only)
• Barracuda Web Application Firewall (WAF) (CVE-2026-111560 only)
• Barracuda Web Security Gateway (WSG) (CVE-2026-111560 only)

What to do now

1. Upgrade Barracuda Email Security Gateway to the latest firmware and confirm patch BNSF-40425 (9.4.017+) or BNSF-40430 (<9.4.017) is applied.
2. Update all other affected Barracuda products to their latest firmware and confirm the matching patch: BNADC-16586 (ADC and WAF), BNMA-32468 (BMA), BNWF-60060 (WCC) or BNYF-24789 (WSG).
3. Restrict administrative interface access to trusted internal networks only.
4. Implement network access controls to ensure management interfaces are not exposed to the internet.
5. Enable automatic patching if it is currently disabled, and apply the patch manually on any device where it was not installed automatically.

What we don't know yet

• Whether these vulnerabilities are currently being exploited in the wild. Neither advisory says.
• The exact number of vulnerable devices currently exposed.
• Why Barracuda lists CVE-2026-116606 as requiring administrative access while Mandiant describes it as exposed to an unauthenticated remote attacker.
• The fixed firmware version numbers for the products other than the ESG, which Barracuda's advisory does not list.