Barracuda published a security advisory on November 2, 2026, describing two vulnerabilities in its products: a pre-authentication authorization bypass (CVE-2026-116606, CVSS 9.3) and command injection (CVE-2026-111560, CVSS 8.6). When exploited as a chain, an attacker with network access to the device’s administrative interface can bypass authorization controls and obtain root access. The full chain affects only the Barracuda Email Security Gateway — the only product vulnerable to both issues at the same time. Patches are already available, and the key risk-reduction measure is restricting access to the administrative interface.
Technical details of the vulnerabilities
CVE-2026-116606 is a pre-authentication authorization bypass vulnerability affecting only Barracuda Email Security Gateway. According to the Mandiant disclosure, the vulnerability is classified as CWE-288 (Authentication Bypass Using an Alternate Path or Channel). Mandiant reports that an unauthenticated remote attacker can invoke the configuration import function and restore a specially crafted backup archive, leading to unauthorized modification of the device’s global configuration. Authentication is not required — network reachability of the administrative interface is sufficient.
CVE-2026-111560 is a command injection vulnerability that affects a significantly broader set of Barracuda products:
- Email Security Gateway (ESG)
- Load Balancer Application Delivery Controller (ADC)
- Message Archiver (BMA)
- WAF Control Center (WCC)
- Web Application Firewall (WAF)
- Web Security Gateway (WSG)
Exploitation of CVE-2026-111560 requires administrative access to the device. This is exactly why the chain of the two vulnerabilities is critically dangerous: CVE-2026-116606 allows an attacker to bypass authentication on ESG, after which CVE-2026-111560 can be used to execute arbitrary commands with root privileges. For the other five products, CVE-2026-111560 can be exploited only if legitimate administrative credentials are available, which significantly reduces the practical risk.
Discrepancies in affected version data
An important detail that administrators should note: the boundaries of affected ESG versions differ between sources. In its patch table, Barracuda uses version 9.4.017 as the split point for routing updates — systems on version 9.4.017 and above receive patch BNSF-40425, while systems below 9.4.017 receive patch BNSF-40430. Mandiant, however, states that CVE-2026-116606 affects ESG versions earlier than 9.4.0.030. Available sources do not allow these two threshold values to be reconciled unambiguously. Administrators should follow Barracuda’s recommendations for the specific patch applicable to their firmware version, rather than relying on a single numeric boundary.
Exploitation status
At the time of publication, neither vulnerability has been added to the CISA Known Exploited Vulnerabilities catalog. The reviewed sources contain no evidence of active exploitation, attribution to specific threat actors, victim data, or indicators of compromise.
At the same time, the public watchTowr repository hosts an artifact for testing the exploit chain vulnerability on ESG, including a demonstration of command execution (creation of the /tmp/test file). The presence of a public validation tool means that the technical ability to reproduce the attack is available to a wide audience, which increases the likelihood of real-world attacks in the near future. However, the mere existence of such a tool is not, by itself, proof of exploitation in the wild.
Impact assessment
Organizations whose Barracuda ESG devices expose an administrative interface to the internet are at the greatest risk. For such systems, the CVE-2026-116606 → CVE-2026-111560 chain offers a direct path to complete device compromise without the need for authentication. Since ESG processes all incoming and outgoing email traffic for an organization, compromise of the device can lead to interception of corporate correspondence, injection of malicious content into the mail flow, and use of the device as a foothold for further penetration into the network.
For the other five affected products (ADC, BMA, WCC, WAF, WSG), risk is limited to a command injection scenario given existing administrative access — a serious but less likely threat if basic access management practices are followed.
Recommendations
Top priority — Barracuda ESG with an administrative interface accessible from the internet:
- Immediately restrict access to the ESG administrative interface, allowing connections only from trusted internal networks.
- Check the current firmware version and identify the applicable patch: BNSF-40425 for systems on version 9.4.017 and above, BNSF-40430 for systems below 9.4.017.
- Apply the patch manually if automatic updating did not complete. Barracuda notes that if the firmware version is significantly outdated, several sequential updates may be required.
- Enable automatic patch retrieval if this feature has been disabled.
For the other affected products — apply the corresponding patches: BNADC-16586 for ADC and WAF, BNMA-32468 for Message Archiver, BNWF-60060 for WAF Control Center, BNYF-24789 for Web Security Gateway.
Organizations operating Barracuda ESG should treat this pair of vulnerabilities as requiring immediate response: the combination of a CVSS 9.3 score for the authentication bypass, the presence of a public validation tool, and the critical role of the email gateway in the infrastructure leaves no room for postponing the update. The first-priority action is to ensure that the ESG administrative interface is not accessible from the internet and to apply the appropriate patch from Barracuda.
