Barracuda Email Security Gateway

CVE-2026-116606 / CVE-2026-111560, Barracuda Email Security Gateway: an unauthenticated configuration-import bypass chained with a root command injection through the administrative interface; patches are out and no exploitation is reported (CVSS 9.3 and 8.6)

Barracuda's advisory of 2026-11-02 covers two flaws that, chained, give root on the appliance: CVE-2026-116606, a pre-authentication authorization bypass in the Email Security Gateway, and CVE-2026-111560, a command injection that also affects the Load Balancer ADC, Message Archiver, WAF Control Center, Web Application Firewall and Web Security Gateway (Barracuda, 2026-11-02). Barracuda says successful exploitation requires access to the administrative interface and that, in combination, the flaws let an attacker bypass authorization controls and obtain root (Barracuda, 2026-11-02). Mandiant's disclosure describes the first as letting an unauthenticated remote attacker invoke the gateway's configuration-import function and restore a crafted backup archive, which changes the appliance's global configuration (Mandiant, 2026-11-02), and the second as shell metacharacters in the timezone configuration field that let an authenticated administrator run commands as root when the crafted value is processed, in Email Security Gateway versions up to 9.4.0.27, Load Balancer ADC versions up to 6.4.0, Web Application Firewall versions up to 11.0.1, Web Security Gateway versions up to 16.1.100.100, Message Archiver versions up to 5.5.4.0 and WAF Control Center versions up to 2.2.1 (Mandiant, 2026-11-02). NCSC Switzerland rates the exploitation status unknown and notes that the vendor's table lists administrative access as the authentication requirement although it calls CVE-2026-116606 a pre-authentication bypass (NCSC Switzerland, 2026-11-03). No source reports attacks or a public exploit.

Barracuda released patches (BNSF-40425 from firmware 9.4.017 and BNSF-40430 below it for the gateway, BNADC-16586 for the Load Balancer ADC and the Web Application Firewall, BNMA-32468 for the Message Archiver, BNWF-60060 for the WAF Control Center, BNYF-24789 for the Web Security Gateway) and asks customers to apply any patch that was not applied automatically and to turn automatic patching on (Barracuda, 2026-11-02). Its Campus article names firmware 9.4.0.029 or later for the Email Security Gateway (Barracuda Campus, 2026-11-02), while the CVE record lists versions earlier than 9.4.0.030 as affected (Mandiant, 2026-11-02); 9.4.0.030 or later satisfies both.