Barracuda Patches Two Flaws That Chain to Root on Email Gateways and Web Application Firewalls

Barracuda Networks has released patches for two vulnerabilities that, used together, can give an attacker full administrative control, known as root access, of several Barracuda security appliances. The flaws are CVE-2026-116606 in the Barracuda Email Security Gateway and CVE-2026-111560, which affects six Barracuda products. Barracuda published its advisory on 2 November 2026. As of 3 November, Barracuda has not reported any attacks using these flaws, and neither CVE is on the Cybersecurity and Infrastructure Security Agency (CISA) Known Exploited Vulnerabilities (KEV) catalog. This is the time to patch, before that changes.

What the two flaws are. CVE-2026-116606 is an authorization bypass in the Email Security Gateway (ESG). According to the CVE record, an attacker who can reach the appliance without logging in can call its configuration-import function and load a crafted backup file, which changes the appliance's global configuration. It affects ESG versions earlier than 9.4.0.030 and is rated 9.3 out of 10 on the Common Vulnerability Scoring System (CVSS). CVE-2026-111560 is a command injection flaw, which means text typed into a setting is passed to the operating system and run as a command. In this case the vulnerable setting is the timezone field, and the commands run as root. It requires administrator access on its own and is rated 8.6. Barracuda warns that the two flaws can be chained: the first gets around the login controls and the second turns that into root access.

Which products are affected. Both CVEs affect the Email Security Gateway. CVE-2026-111560 also affects the Load Balancer Application Delivery Controller (ADC), the Message Archiver (BMA), the Web Application Firewall (WAF), the WAF Control Center (WCC) and the Web Security Gateway (WSG). Barracuda lists a patch for each product: BNSF-40425 for ESG firmware 9.4.017 and later, BNSF-40430 for ESG firmware earlier than 9.4.017, BNADC-16586 for the ADC and the WAF, BNMA-32468 for the Message Archiver, BNWF-60060 for the WAF Control Center and BNYF-24789 for the Web Security Gateway.

Why this matters even without known attacks. Barracuda says exploitation requires access to the appliance's administrative interface, and that organizations whose administrative interfaces are not reachable from the internet are less exposed. That is the key question for every site. Barracuda's Email Security Gateway also has a history: in 2023, a China-linked group that Mandiant tracks as UNC4841 exploited a zero-day, a flaw attackers use before a patch exists, in the ESG (CVE-2023-2868) for at least seven months before it was found. Security appliances are attractive targets because they sit at the edge of the network, they are trusted, and few teams watch them closely.

Where these appliances show up from the plant floor to the cloud. Utilities, pipelines, manufacturers and chemical plants commonly run Barracuda email gateways, web filters and web application firewalls on the business network and at the internet edge. A web application firewall often sits in front of remote access portals, vendor support pages or data-sharing servers in the demilitarized zone (DMZ), the buffer network between the business network and the control system. Many smaller sites, such as water districts, buy these appliances as managed services from an IT provider, so the plant team may not know which version is running or who holds the administrator login. A compromised edge appliance can be used to read email, steal passwords, or get a foothold on the networks that lead toward the control room.

What the Red Tiger team recommends:

1. Find every Barracuda appliance. Include virtual and cloud instances and any that your IT provider or managed service provider runs for you. Record the product, firmware version and who is responsible for patching it.
2. Confirm the patch is installed. Barracuda says patches may be applied automatically, but check each appliance for the patch listed for your product. If automatic patching was turned off, Barracuda recommends turning it back on. Devices several firmware versions behind may need more than one update.
3. Take the administrative interface off the internet. Make sure the management web page cannot be reached from the internet or from untrusted networks. Allow access only from a management network or jump host, which is a hardened computer used only for administration, and require multi-factor authentication for administrators.
4. Look for signs of tampering. Review the appliance's audit logs for configuration imports, backup restores, timezone changes or new administrator accounts that nobody on your team made. If you find one, contact Barracuda Support, treat the appliance as compromised and change any passwords and keys it stores.

With 500+ plant-safe assessments across critical infrastructure, the Red Tiger Security team helps owners find the edge devices sitting between the internet and their control systems and close the paths into them.

We are here to help, so check out our resources online at www.redtigersecurity.com and book a follow-up call with our team if you have any questions: https://calendly.com/jonathanpollet/30min

Sources:

Barracuda Networks, "Pre-Authentication Authorization Bypass and Command Injection Vulnerabilities in Certain Barracuda Products," 2 November 2026: https://trust.barracuda.com/security/pre-authentication-authorization-bypass-command-injection

NVD record for CVE-2026-116606: https://nvd.nist.gov/vuln/detail/CVE-2026-116606

NVD record for CVE-2026-111560: https://nvd.nist.gov/vuln/detail/CVE-2026-111560

BleepingComputer, "Barracuda warns of critical flaws allowing root access to devices," 3 November 2026: https://www.bleepingcomputer.com/news/security/barracuda-warns-of-critical-flaws-allowing-root-access-to-devices/

‍