Barracuda has shipped fixes for two vulnerabilities that, together, let an attacker who can reach an Email Security Gateway (ESG) admin interface take the appliance as root. The advisory went out on November 2, 2026. Nobody has reported exploitation yet. But Barracuda ESG was the target of the UNC4841 espionage campaign in 2022–2023, so it’s worth patching this week rather than next quarter.
The two bugs
CVE-2026-116606: pre-authentication authorization bypass (ESG only). Mandiant discovered both flaws and is the CNA for both. Its record describes an authentication bypass that lets “an unauthenticated remote attacker” call ESG’s configuration-import function and restore a crafted backup archive. That overwrites the appliance’s global configuration: mail routing, relay and policy settings, and admin settings. The weakness is CWE-288 (authentication bypass using an alternate path). Mandiant scores it 9.3 (CVSS 4.0).
CVE-2026-111560: OS command injection as root (six products). Mandiant says the timezone configuration field doesn’t neutralize shell metacharacters. This code is shared across Barracuda’s appliance line, so an administrator can inject commands that run as root. It is CWE-78 and scores 8.6 (CVSS 4.0). It affects ESG, Load Balancer ADC, Web Application Firewall, WAF Control Center, Message Archiver and Web Security Gateway.
Barracuda’s warning is short: “If exploited in combination, these vulnerabilities could allow an attacker to bypass authorization controls and obtain root access to the device.” The full chain only exists on ESG, because only ESG has both bugs. On the other five products, CVE-2026-111560 still gives root to anyone holding admin credentials, so weak or shared admin passwords matter.
A small disagreement about authentication
Barracuda’s advisory says exploitation “requires an attacker to have access to the administrative interface”, and some coverage has read that as needing admin credentials. Mandiant’s CNA record says the ESG bypass works for an unauthenticated attacker. Both agree the attacker has to reach the admin interface. Until Barracuda clarifies, treat any ESG admin UI that is reachable from an untrusted network as exposed.
What to install
| Product | CVE-2026-116606 | CVE-2026-111560 | Patch |
|---|---|---|---|
| Email Security Gateway | Yes | Yes | BNSF-40425 (9.4.017+), BNSF-40430 (older) |
| Load Balancer ADC | No | Yes | BNADC-16586 |
| Web Application Firewall | No | Yes | BNADC-16586 |
| WAF Control Center | No | Yes | BNWF-60060 |
| Message Archiver | No | Yes | BNMA-32468 |
| Web Security Gateway | No | Yes | BNYF-24789 |
On ESG, Barracuda’s Campus documentation says to move to firmware 9.4.0.029 or later and confirm the installed version under Advanced > Firmware Update. Appliances on 9.1 through 9.4.0.027 get a security update. Anything older than 9.1 needs a two-step upgrade, because it can’t jump straight to 9.4.0.029. The CNA record gives the affected range as “earlier than 9.4.0.030”, so check the build on the device itself instead of guessing from version strings.
What to do today
- Patch, then verify. Check Advanced > Firmware Update on every ESG and repeat the update until it reports 9.4.0.029 or later. Confirm the matching patch on the other five products.
- Close the admin UI. Every attack path here starts at the administrative interface. If an ESG, WAF or ADC console answers from the internet, put it behind a VPN or IP allowlist.
- Review admin accounts. CVE-2026-111560 turns any admin login into root. Rotate shared credentials and remove unused accounts.
- Check ESG configuration integrity. Compare the current configuration with a known-good backup and look for routing, relay or policy changes nobody made. Look for a configuration import nobody remembers running.
- Ask your MSP. If a provider runs the appliance for you, get written confirmation of the patch level and who can reach the console.
Neither CVE is in CISA’s KEV catalog as of this writing, and neither Barracuda nor Mandiant has published indicators of compromise.
