Barracuda Patches ESG Flaw Chain That Can Give Attackers Root Access

What Barracuda disclosed​

Barracuda's advisory was published and updated on November 2, 2026. It says the flaws, if exploited in combination, could let an attacker bypass authorization controls and obtain root. The company says it has released security patches for the affected products.

• CVE-2026-116606 is an authorization bypass in Email Security Gateway (ESG). Barracuda rates it CVSS 9.3. Mandiant's disclosure describes it as an authentication bypass in ESG versions earlier than 9.4.0.030. In Mandiant's account, an unauthenticated remote attacker can call the configuration-import function and restore a crafted, compatible backup archive. That lets the attacker modify the appliance's global configuration.
• CVE-2026-111560 is an OS command injection, rated CVSS 8.6. Mandiant says the flaw is improper neutralization of shell metacharacters in the timezone configuration field. An authenticated administrator can inject commands that run as root when the crafted timezone value is processed. It affects six product families that share common Barracuda code.

The authentication discrepancy​

Barracuda's advisory says successful exploitation requires access to the administrative interface of an affected product. It lists "Authentication Required: Yes, administrative access" for both CVEs.

Mandiant scores CVE-2026-116606 with no privileges required and describes it as exposed to an unauthenticated remote attacker. Barracuda's advisory title also says "pre-authentication." One independent write-up from HOL noted the same inconsistency between Barracuda's summary block and the CVE record.

I found no source that explains the gap. A plausible reading is that "pre-authentication" means the attacker needs no login, but must be able to reach the admin web interface. That is my inference, not something Barracuda or Mandiant has stated. Treat the two accounts separately:

• Barracuda says the attacker needs reach to the administrative interface.
• Mandiant says no credentials are needed for CVE-2026-116606.
• Both agree the chain ends in root.

Either way, an exposed admin interface is the condition that matters most.

Affected products and patches​

Mandiant's version boundaries for CVE-2026-111560 are:

• ESG 9.4.0.27 and earlier
• ADC 6.4.0 and earlier
• WAF 11.0.1 and earlier
• WSG 16.1.100.100 and earlier
• BMA 5.5.4.0 and earlier
• WCC 2.2.1 and earlier

For CVE-2026-116606, Mandiant's affected range is ESG earlier than 9.4.0.030. Use these ranges to identify vulnerable builds. Use Barracuda's patch IDs for remediation.

What to do​

1. Inventory your Barracuda appliances. Check ESG, ADC, WAF, WCC, WSG and BMA. Only ESG is affected by both flaws. The other five are affected by the command injection only.
2. Confirm firmware and patch status. Barracuda says the device shows the latest firmware version available. If a patch was not applied automatically, apply the right one manually as soon as possible.
3. Turn automatic patching back on if it was disabled. Barracuda recommends this setting.
4. Expect more than one update on old units. Barracuda says a device that is several firmware versions behind may need multiple updates.
5. Restrict the admin interface. Barracuda says organizations whose administrative interfaces are not publicly reachable from the internet are less exposed. It recommends limiting admin access to trusted internal networks and using network access controls. That reduces exposure but does not replace patching.
6. Get help if you need it. Barracuda points customers to Barracuda Campus for manual patch and firmware steps, and to Barracuda Support for verification help.

Exploitation status and timeline​

According to Mandiant's records, Barracuda reported CVE-2026-111560 on October 15 and CVE-2026-116606 on October 22. Both CVEs and Mandiant's advisories were published on November 2. One third-party tracker says Barracuda's fix summary lists both flaws as not exploited. I could not confirm that against Barracuda's advisory text, so treat it as unverified. Neither the advisory nor Mandiant's disclosures I reviewed reports active exploitation or a public proof of concept. The same tracker notes that Barracuda and Mandiant have not published technical details of the bypass path.

Why this matters​

Barracuda gateways often sit at the edge of a network, in front of mail and web traffic. Root on one of them gives an attacker a strong foothold, and a rewritten global configuration could change how mail or traffic is handled. That is general industry reasoning and is not drawn from the advisory.

Barracuda has a history here. BleepingComputer's coverage notes that ESG appliances were hit by earlier zero-day attacks in 2023. Nothing in the current advisory links those incidents to these flaws, so don't read a connection into them.

Patch first. Then ask why an appliance admin interface was reachable from anywhere it shouldn't be.