CVE-2026-116606 / CVE-2026-111560, Barracuda Email Security Gateway: an unauthenticated configuration-import bypass chained with a root command injection through the administrative interface; patches are out and no exploitation is reported (CVSS 9.3 and 8.6)
Barracuda ESG: auth bypass plus command injection reach root via the admin interface; no attacks reported
Defender actions
- Restrict the administrative interface of every Barracuda Email Security Gateway, Load Balancer ADC, Message Archiver, WAF Control Center, Web Application Firewall and Web Security Gateway to trusted internal networks now, update every Email Security Gateway to firmware 9.4.0.030 or later, which satisfies both Barracuda Campus (9.4.0.029 or later) and the CVE record (builds before 9.4.0.030 are affected), and apply Barracuda's patch to each of the other products (BNADC-16586 for the Load Balancer ADC and the Web Application Firewall, BNMA-32468, BNWF-60060, BNYF-24789), confirming that automatic patching is on.
Analysis
Barracuda's advisory of 2026-11-02 covers two flaws that, chained, give root on the appliance: CVE-2026-116606, a pre-authentication authorization bypass in the Email Security Gateway, and CVE-2026-111560, a command injection that also affects the Load Balancer ADC, Message Archiver, WAF Control Center, Web Application Firewall and Web Security Gateway (Barracuda, 2026-11-02). Barracuda says successful exploitation requires access to the administrative interface and that, in combination, the flaws let an attacker bypass authorization controls and obtain root (Barracuda, 2026-11-02). Mandiant's disclosure describes the first as letting an unauthenticated remote attacker invoke the gateway's configuration-import function and restore a crafted backup archive, which changes the appliance's global configuration (Mandiant, 2026-11-02), and the second as shell metacharacters in the timezone configuration field that let an authenticated administrator run commands as root when the crafted value is processed, in Email Security Gateway versions up to 9.4.0.27, Load Balancer ADC versions up to 6.4.0, Web Application Firewall versions up to 11.0.1, Web Security Gateway versions up to 16.1.100.100, Message Archiver versions up to 5.5.4.0 and WAF Control Center versions up to 2.2.1 (Mandiant, 2026-11-02). NCSC Switzerland rates the exploitation status unknown and notes that the vendor's table lists administrative access as the authentication requirement although it calls CVE-2026-116606 a pre-authentication bypass (NCSC Switzerland, 2026-11-03). No source reports attacks or a public exploit.
Barracuda released patches (BNSF-40425 from firmware 9.4.017 and BNSF-40430 below it for the gateway, BNADC-16586 for the Load Balancer ADC and the Web Application Firewall, BNMA-32468 for the Message Archiver, BNWF-60060 for the WAF Control Center, BNYF-24789 for the Web Security Gateway) and asks customers to apply any patch that was not applied automatically and to turn automatic patching on (Barracuda, 2026-11-02). Its Campus article names firmware 9.4.0.029 or later for the Email Security Gateway (Barracuda Campus, 2026-11-02), while the CVE record lists versions earlier than 9.4.0.030 as affected (Mandiant, 2026-11-02); 9.4.0.030 or later satisfies both.
Cited evidence
If exploited in combination, these vulnerabilities could allow an attacker to bypass authorization controls and obtain root access to the device
Successful exploitation requires an attacker to have access to the administrative interface of an affected product.
allows an unauthenticated remote attacker to invoke a configuration-import function and restore a crafted, compatible backup archive
allows an authenticated administrator to inject OS commands that execute with root privileges when the crafted timezone value is subsequently processed
Appliances should upgrade to 9.4.0.029 and above.
Sources5
AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.