--- schema: 1 kind: vulnerability title: "CVE-2026-116606 / CVE-2026-111560, Barracuda Email Security Gateway: an unauthenticated configuration-import bypass chained with a root command injection through the administrative interface; patches are out and no exploitation is reported (CVSS 9.3 and 8.6)" headline: "Barracuda ESG: auth bypass plus command injection reach root via the admin interface; no attacks reported" summary: > Barracuda's advisory of 2026-11-02 covers CVE-2026-116606, a pre-authentication authorization bypass in the Email Security Gateway (CVSS 9.3) that lets an unauthenticated remote attacker restore a crafted backup archive through the configuration-import function, and CVE-2026-111560, a command injection in the timezone field (8.6) that also affects the Load Balancer ADC, Message Archiver, WAF Control Center, Web Application Firewall and Web Security Gateway; chained, they give root, and Barracuda says exploitation needs access to the administrative interface. Patches are out; NCSC Switzerland rates exploitation unknown and no source reports attacks. Barracuda's Campus article names firmware 9.4.0.029 while the CVE record lists builds before 9.4.0.030 as affected. discovered_at: "2026-11-04T03:40:00Z" updated_at: null event_date: "2026-11-02" run_id: 2026-11-04T0256Z-intel priority: notable immediate_action: null tags: [vulnerabilities, auth-bypass, rce, pre-auth, patch-available] regions: [global] sectors: [] entities: ["product:barracuda-email-security-gateway", "product:barracuda-load-balancer-adc", "product:barracuda-message-archiver", "product:barracuda-waf-control-center", "product:barracuda-web-application-firewall", "product:barracuda-web-security-gateway"] techniques: [T1190, T1059.004] affected_products: ["Barracuda Email Security Gateway", "Barracuda Load Balancer ADC", "Barracuda Message Archiver", "Barracuda WAF Control Center", "Barracuda Web Application Firewall", "Barracuda Web Security Gateway"] cves: - id: CVE-2026-116606 cvss: "9.3" epss: null type: auth-bypass vector: zero-click auth: pre-auth status: [patch-available] affected: "Barracuda Email Security Gateway before 9.4.0.030 per the Mandiant CVE record; all versions per Barracuda Campus" fixed: "firmware 9.4.0.030 or later satisfies both the CVE record and Barracuda Campus (9.4.0.029 or later); patches BNSF-40425 (9.4.017 and later) and BNSF-40430 (earlier)" - id: CVE-2026-111560 cvss: "8.6" epss: null type: rce vector: zero-click auth: admin-required status: [patch-available] affected: "Email Security Gateway versions up to 9.4.0.27, Load Balancer ADC versions up to 6.4.0, Web Application Firewall versions up to 11.0.1, Web Security Gateway versions up to 16.1.100.100, Message Archiver versions up to 5.5.4.0 and WAF Control Center versions up to 2.2.1, per the Mandiant CVE record" fixed: "BNSF-40425 (9.4.017 and later) and BNSF-40430 (earlier) for the Email Security Gateway, BNADC-16586 for the Load Balancer ADC and the Web Application Firewall, BNMA-32468 for the Message Archiver, BNWF-60060 for the WAF Control Center and BNYF-24789 for the Web Security Gateway" sources: - url: "https://trust.barracuda.com/security/pre-authentication-authorization-bypass-command-injection" publisher: "Barracuda Trust Center" date: "2026-11-02" role: primary - url: "https://documentation.campus.barracuda.com/wiki/spaces/BSFv51/pages/963739728" publisher: "Barracuda Campus" date: "2026-11-02" role: primary - url: "https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2026/MNDT-2026-0042.md" publisher: "Mandiant (CVE-2026-116606 disclosure)" date: "2026-11-02" role: corroborating - url: "https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2026/MNDT-2026-0041.md" publisher: "Mandiant (CVE-2026-111560 disclosure)" date: "2026-11-02" role: corroborating - url: "https://security-hub.ncsc.admin.ch/#/posts/13144" publisher: "NCSC Switzerland (Security Hub post 13144)" date: "2026-11-03" role: corroborating closed_sources: [] evidence: - quote: "If exploited in combination, these vulnerabilities could allow an attacker to bypass authorization controls and obtain root access to the device" publisher: "Barracuda Trust Center" source_url: "https://trust.barracuda.com/security/pre-authentication-authorization-bypass-command-injection" - quote: "Successful exploitation requires an attacker to have access to the administrative interface of an affected product." publisher: "Barracuda Trust Center" source_url: "https://trust.barracuda.com/security/pre-authentication-authorization-bypass-command-injection" - quote: "allows an unauthenticated remote attacker to invoke a configuration-import function and restore a crafted, compatible backup archive" publisher: "Mandiant (CVE-2026-116606 disclosure)" source_url: "https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2026/MNDT-2026-0042.md" - quote: "allows an authenticated administrator to inject OS commands that execute with root privileges when the crafted timezone value is subsequently processed" publisher: "Mandiant (CVE-2026-111560 disclosure)" source_url: "https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2026/MNDT-2026-0041.md" - quote: "Appliances should upgrade to 9.4.0.029 and above." publisher: "Barracuda Campus" source_url: "https://documentation.campus.barracuda.com/wiki/spaces/BSFv51/pages/963739728" verification: multi-source sourcing_note: > Barracuda's advisory and its Campus article are the vendor's own statements, and NCSC Switzerland restates them and rates the exploitation status unknown; Mandiant's per-vulnerability disclosure pages, whose timeline records the CVE publication and the Mandiant advisory on 2026-11-02, give the independent description of the mechanism and of the affected ranges. Barracuda's patch table lists the authentication requirement as administrative access although it calls CVE-2026-116606 a pre-authentication bypass, as NCSC Switzerland points out. The fixed-build tension is between Barracuda Campus (9.4.0.029 or later) and the Mandiant CVE record (builds before 9.4.0.030 are affected). The CVSS scores are those NCSC Switzerland gives for the two CVEs. confidence: high references: [] deep_dive: false deep_dive_category: null org_triage: null classification: reliability: A credibility: 2 watchlist_hit: false actions: - "Restrict the administrative interface of every Barracuda Email Security Gateway, Load Balancer ADC, Message Archiver, WAF Control Center, Web Application Firewall and Web Security Gateway to trusted internal networks now, update every Email Security Gateway to firmware 9.4.0.030 or later, which satisfies both Barracuda Campus (9.4.0.029 or later) and the CVE record (builds before 9.4.0.030 are affected), and apply Barracuda's patch to each of the other products (BNADC-16586 for the Load Balancer ADC and the Web Application Firewall, BNMA-32468, BNWF-60060, BNYF-24789), confirming that automatic patching is on." updates: [] migrated_from: null --- Barracuda's advisory of 2026-11-02 covers two flaws that, chained, give root on the appliance: CVE-2026-116606, a pre-authentication authorization bypass in the Email Security Gateway, and CVE-2026-111560, a command injection that also affects the Load Balancer ADC, Message Archiver, WAF Control Center, Web Application Firewall and Web Security Gateway ([Barracuda, 2026-11-02](https://trust.barracuda.com/security/pre-authentication-authorization-bypass-command-injection)). Barracuda says successful exploitation requires access to the administrative interface and that, in combination, the flaws let an attacker bypass authorization controls and obtain root ([Barracuda, 2026-11-02](https://trust.barracuda.com/security/pre-authentication-authorization-bypass-command-injection)). Mandiant's disclosure describes the first as letting an unauthenticated remote attacker invoke the gateway's configuration-import function and restore a crafted backup archive, which changes the appliance's global configuration ([Mandiant, 2026-11-02](https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2026/MNDT-2026-0042.md)), and the second as shell metacharacters in the timezone configuration field that let an authenticated administrator run commands as root when the crafted value is processed, in Email Security Gateway versions up to 9.4.0.27, Load Balancer ADC versions up to 6.4.0, Web Application Firewall versions up to 11.0.1, Web Security Gateway versions up to 16.1.100.100, Message Archiver versions up to 5.5.4.0 and WAF Control Center versions up to 2.2.1 ([Mandiant, 2026-11-02](https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2026/MNDT-2026-0041.md)). NCSC Switzerland rates the exploitation status unknown and notes that the vendor's table lists administrative access as the authentication requirement although it calls CVE-2026-116606 a pre-authentication bypass ([NCSC Switzerland, 2026-11-03](https://security-hub.ncsc.admin.ch/#/posts/13144)). No source reports attacks or a public exploit. Barracuda released patches (BNSF-40425 from firmware 9.4.017 and BNSF-40430 below it for the gateway, BNADC-16586 for the Load Balancer ADC and the Web Application Firewall, BNMA-32468 for the Message Archiver, BNWF-60060 for the WAF Control Center, BNYF-24789 for the Web Security Gateway) and asks customers to apply any patch that was not applied automatically and to turn automatic patching on ([Barracuda, 2026-11-02](https://trust.barracuda.com/security/pre-authentication-authorization-bypass-command-injection)). Its Campus article names firmware 9.4.0.029 or later for the Email Security Gateway ([Barracuda Campus, 2026-11-02](https://documentation.campus.barracuda.com/wiki/spaces/BSFv51/pages/963739728)), while the CVE record lists versions earlier than 9.4.0.030 as affected ([Mandiant, 2026-11-02](https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2026/MNDT-2026-0042.md)); 9.4.0.030 or later satisfies both. **Exposure:** an Email Security Gateway of any version before the fix, or a Load Balancer ADC, Message Archiver, WAF Control Center, Web Application Firewall or Web Security Gateway for the command injection, whose administrative interface can be reached; NCSC Switzerland puts internet-exposed management interfaces at the highest risk ([NCSC Switzerland, 2026-11-03](https://security-hub.ncsc.admin.ch/#/posts/13144)), and Barracuda says organisations whose administrative interfaces are not publicly accessible from the internet are less exposed to this attack path ([Barracuda, 2026-11-02](https://trust.barracuda.com/security/pre-authentication-authorization-bypass-command-injection)). The appliance reports its firmware version, which should read 9.4.0.030 or later after the update (Barracuda Campus names 9.4.0.029 as its own figure) ([Barracuda Campus, 2026-11-02](https://documentation.campus.barracuda.com/wiki/spaces/BSFv51/pages/963739728)). **Detection:** Barracuda's advisory names no indicators. The mechanism points to the administrative interface's access logs, where a request to the configuration-import function from an address that is not an administrator's, or a configuration restore nobody made, is the sign of the bypass, and to changes of the timezone setting followed by root-owned child processes under the management service as the sign of the command injection. **Defender takeaway:** take the administrative interface of every affected Barracuda appliance off the internet and out of any untrusted network, update every Email Security Gateway to 9.4.0.030 or later, apply the patch listed for each of the other products and confirm that automatic patching is on; Barracuda recommends restricting administrative interfaces to trusted internal networks ([Barracuda, 2026-11-02](https://trust.barracuda.com/security/pre-authentication-authorization-bypass-command-injection)).