Two Barracuda Bugs Chain From No Password to Root on Email Gateways
Barracuda patched CVE-2026-116606 (CVSS 9.3), an unauthenticated config-restore bypass in Email Security Gateway, and CVE-2026-111560 (8.6), a root command injection in six product lines. Chained, they give root. No exploitation reported yet.
Barracuda has patched two bugs that, used together, turn access to an appliance’s admin page into root on the box. Barracuda’s Nov. 2 advisory rates the authentication bypass in Email Security Gateway (ESG) at CVSS 9.3 and a command-injection bug spread across six product lines at 8.6, BleepingComputer reports. Neither is reported as exploited, but ESG has history: Chinese spies lived inside it for months in 2023.
For defenders
| CVE | What it is | CVSS (Barracuda) | Products |
|---|---|---|---|
| CVE-2026-116606 | Authentication bypass that lets an attacker restore a crafted configuration backup (ESG before 9.4.0.030) | 9.3 | Email Security Gateway only |
| CVE-2026-111560 | OS command injection that runs as root, for a user with admin rights | 8.6 | ESG, Load Balancer ADC, Message Archiver, WAF, WAF Control Center, Web Security Gateway |
The chain: on ESG the first bug gets around the authorization check and the second turns that into root commands. Both need network access to the administrative interface. Barracuda’s advisory is muddled on whether you need to log in first (its title says “pre-authentication”, its detail table says admin access is required), but the CVE records settle it for the first bug: CVE-2026-116606 lets an unauthenticated attacker call a configuration-import function and restore a crafted backup on ESG before 9.4.0.030 (CVSS 4.0 vector with PR:N). CVE-2026-111560 is shell metacharacters in the timezone setting, processed as root (PR:H). Put together: no password, then root. Barracuda says appliances whose admin interfaces aren’t reachable from the internet are “less exposed”.
Status: no in-the-wild exploitation reported, not in CISA’s KEV catalog, no public exploit in Metasploit, Exploit-DB, Nuclei or GitHub, and EPSS is low (0.7% and 0.5%). Mandiant filed both CVE records; Barracuda’s advisory credits no researcher.
Patches: ESG BNSF-40425 (9.4.017 and later) or BNSF-40430 (before 9.4.017); Load Balancer ADC and WAF BNADC-16586; Message Archiver BNMA-32468; WAF Control Center BNWF-60060; Web Security Gateway BNYF-24789. Barracuda pushes patches automatically where that’s enabled, but tells customers to apply them by hand if they didn’t land, to switch automatic patching back on where it was turned off, and to expect several updates on firmware that’s far behind. Only ESG has version-specific guidance; for the rest, run the latest firmware.
Why it matters: UNC4841 exploited the ESG zero-day CVE-2023-2868 from at least October 2022 to drop SeaSpy and Saltwater, and Mandiant found close to a third of the hacked appliances belonged to government agencies. Email gateways sit on every message an organization sends, which is why they keep getting targeted.
What it means for you
If your business filters email or web traffic through a Barracuda box, this is your IT provider’s job this week. The risk is someone taking full control of the device that reads all of your email. If you don’t use Barracuda products, there’s nothing to do.
Do this now
- Confirm each Barracuda appliance has the patch ID listed above for its product, and apply it by hand if automatic patching missed it.
- Turn automatic patch updates back on for any device where they were disabled.
- Take admin interfaces off the internet: allow them only from a management network or VPN.
- Review admin accounts and configuration changes on ESG appliances for anything you don’t recognize.
CVE at a glance
- CVSS
- 9.3 Critical (v4.0)
- EPSS
- 0.7% chance of exploitation in the next 30 days (higher than 54.3% of CVEs)
- Exploited in the wild
- Not on CISA’s KEV list
- Public exploit
- None reported in public exploit databases
- CVSS
- 8.6 High (v4.0)
- EPSS
- 0.5% chance of exploitation in the next 30 days (higher than 40.8% of CVEs)
- Exploited in the wild
- Not on CISA’s KEV list
- Public exploit
- None reported in public exploit databases
Data from NVD, FIRST EPSS and CISA KEV, refreshed automatically. We report whether public exploit code exists but never link to it: fake proof-of-concepts that infect researchers are common.