Barracuda CVE-2026-116606 chains to root on the email gateway

Barracuda has disclosed two vulnerabilities that, chained on the Email Security Gateway, end in root on the box. CVE-2026-116606 is a pre-authentication authorization bypass scored 9.3, and it affects the Email Security Gateway. CVE-2026-111560 is a command-injection flaw scored 8.6. It affects the gateway plus the Load Balancer ADC, Message Archiver, WAF Control Center, Web Application Firewall, and Web Security Gateway.

Barracuda says the attacker needs a path to the administrative interface. On the Email Security Gateway the pair can be used together to bypass authorization and obtain root. Public reporting on the first bug says it can change the appliance’s global configuration. The second bug, once an admin-level session exists, runs operating-system commands as root. The other five products carry that command-injection bug on its own. Barracuda says customers who keep the admin interface off the internet have less exposure, and it tells every customer to limit that interface to trusted internal networks.

BleepingComputer puts Barracuda’s customer base above 200,000, from small firms through enterprises and managed service providers. The email gateway in that fleet sits in front of the inbox.

The builds that close it

Barracuda’s Email Security Gateway note says every ESG version is affected and that firmware 9.4.0.029 includes the patches. The target is 9.4.0.029 or later, read back on the appliance after it reboots. Appliances on 9.1 through 9.4.0.027 have an update. Anything older than 9.1 needs a stepping-stone release first. Barracuda says those boxes cannot jump straight to 9.4.0.029.

BleepingComputer’s table of the security definitions lists BNSF-40425 for ESG firmware at 9.4.017 and newer, and BNSF-40430 for older builds. Apply the definition that matches the firmware on the device, then confirm the version the box reports.

Canada’s Centre for Cyber Security, in alert AV26-1112 dated November 2, lists ESG builds before 9.4.0.030 as affected. Barracuda’s own page names 9.4.0.029 as the release that contains the fix. Where those two lines disagree, the version on the appliance and Barracuda support settle it. Confirm the string after the reboot.

For the other products, the Canadian alert lists the ranges it treats as affected: Load Balancer ADC before 6.4.0, Web Application Firewall before 11.0.1, Web Security Gateway before 16.1.100.100, Message Archiver before 5.5.4.0, and WAF Control Center before 2.2.1. BleepingComputer lists definition BNADC-16586 for the load balancer, BNMA-32468 for the archiver, BNWF-60060 for WAF Control Center, and BNYF-24789 for the Web Security Gateway. Take the current firmware from Barracuda’s note for each product, including the Web Application Firewall. Where the installed firmware is several releases behind, Barracuda says a single update may leave the box short of the fix.

What to do this week

Remove the administrative interface of every affected appliance from the public internet. Leave it on a management network that administrators already use. Patch the Email Security Gateway first. That is the product where the bypass and the command injection sit on the same box.

After ESG shows 9.4.0.029 or later, write down the version, the date, and the definition ID. Do the same for the load balancer, the archiver, both WAF products, and the web security gateway. An inventory that says only “Barracuda” will leave an old gateway in service.

These appliances terminate mail and web traffic. Root on one is a place to read mail and to change what the organization believes the gateway did. Watch admin logins from outside the management range, configuration changes, and new admin accounts. Store those logs on a system the appliance cannot edit.

In 2023 this same email gateway was hit through CVE-2023-2868 and CVE-2023-7102, activity Mandiant tied to UNC4841, with access that ran for months before the patch. An internet-facing admin port on this product has already been a real intrusion path. This week’s advisories give the scores, the products, and the firmware, and they leave in-the-wild use of these two CVEs unstated. Patch and restrict the interface on the assumption the port is reachable.

This briefing relies on public reporting by The Hacker News and BleepingComputer, on Barracuda’s Email Security Gateway firmware note, and on Canadian Centre for Cyber Security alert AV26-1112. It does not include exploit procedures.