Barracuda Email Security Gateway Flaws Expose Devices to Potential Root-Level Compromise

Barracuda has released security patches for two vulnerabilities that could be exploited to bypass authorization controls and gain root access to affected Email Security Gateway (ESG) appliances.

These vulnerabilities, identified as CVE-2026-116606 and CVE-2026-111560, require attackers to access the device’s administrative interface. Therefore, the exposure of the management interface is a crucial factor in assessing the risk associated with these flaws.

Barracuda Email Security Gateway Flaws

The advisory, published November 2, identifies CVE-2026-116606 as a pre-authentication authorization bypass with a CVSS score of 9.3. CVE-2026-111560 is a command injection vulnerability with a score of 8.6. Both affect ESG, a product previously targeted through a separate Barracuda zero-day vulnerability. Five additional product families are affected only by the newly disclosed command injection issue, not the full two-flaw chain.

The authorization bypass affects ESG versions earlier than 9.4.0.030. According to the National Vulnerability Database, an unauthenticated remote attacker can invoke the configuration-import function and restore a crafted, compatible backup archive.

Successful exploitation allows unauthorized modification of the appliance’s global configuration. Combined with the command injection vulnerability, this weakness could enable escalation from unauthorized configuration changes to root-privileged operating system commands.

Administrative interface access remains a prerequisite, but network reachability should not be mistaken for valid credentials. The authorization bypass specifically undermines pre-authentication controls.

Earlier research into a Barracuda command injection exploit concerned CVE-2023-2868, a different vulnerability. Keeping management interfaces inaccessible from the public internet reduces exposure to the newly disclosed attack path. However, it does not eliminate the need for patches.

For ESG, Barracuda lists patches BNSF-40425 for versions designated 9.4.017 and later, and BNSF-40430 for earlier versions. The command injection fixes include BNADC-16586 for Load Balancer Application Delivery Controller and Web Application Firewall, BNMA-32468 for Message Archiver, BNWF-60060 for WAF Control Center, and BNYF-24789 for Web Security Gateway. Administrators should match the applicable patch to each deployed product.

Barracuda appliances have previously faced targeted exploitation, including a separate ESG zero-day linked to UNC4841. Those historical incidents underscore the importance of appliance security.

However, they do not establish active exploitation of these newly disclosed vulnerabilities. Organizations should distinguish confirmed technical exposure from evidence of compromise when communicating risk and determining their response priorities.

Barracuda recommends restricting administrative access to trusted internal networks and enforcing appropriate network access controls. Customers should verify both their firmware version and patch installation status, rather than assuming that a firmware update alone confirms complete remediation. Devices running substantially outdated firmware may require multiple sequential updates, with support assistance where necessary.

If automatic patching is disabled or an update has not arrived, administrators should apply the relevant fix manually and promptly. The Barracuda Campus remediation guidance provides product-specific instructions for firmware upgrades and patch installation. Organizations should prioritize exposed ESG management interfaces while verifying remediation across every affected appliance in their inventory.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.