Barracuda fixes a root-level flaw pair in Email Security Gateway

Barracuda fixes a root-level flaw pair in Email Security Gateway

2 November 2026: Barracuda has published fixes for two flaws that, used together, let an attacker who can reach the administrative interface of an Email Security Gateway bypass authorisation and run commands as root. CVE-2026-116606, a pre-authentication authorisation bypass rated CVSS 9.3, affects the Email Security Gateway (ESG) only; CVE-2026-111560, a command injection rated CVSS 8.6, affects ESG and five other products. Patches are delivered automatically to appliances that have not switched automatic patching off.

Not yet independently verified. Barracuda gives patch identifiers rather than firmware versions for most products, and says nothing about exploitation; the Dutch NCSC reports no known exploitation and no public exploit code. We will update this when it can be confirmed, and remove this note.

Six products, one admin-interface weakness

Both flaws need access to the administrative interface. The command injection is present in:

• Email Security Gateway, patch BNSF-40425 for firmware 9.4.017 and later, BNSF-40430 below that;
• Load Balancer ADC, BNADC-16586;
• Message Archiver, BNMA-32468;
• Web Application Firewall, BNADC-16586;
• WAF Control Center, BNWF-60060;
• Web Security Gateway, BNYF-24789.

Barracuda says very old firmware may need more than one update to reach the patched state. The advisory was published and last updated on 2 November.

Why the ESG combination is the urgent one

On most of the products the command injection still needs a login. On the ESG, the bypass removes that step, which is why the pair amounts to root on the box. Email gateways have a history here: Barracuda's ESG was the target of a long-running exploitation campaign in 2023 that led the company to tell some customers to replace appliances outright, so attackers know the product well.

The Dutch National Cyber Security Centre said on 4 November that it knew of no active exploitation and no public exploit code, and rated the likelihood of abuse medium and the potential damage high.

Checks for administrators

• Confirm that every appliance shows the patch identifier for its product, especially any where automatic patching was turned off; turn it back on or apply the patch by hand.
• Take the administrative interface off the public internet and restrict it to trusted internal networks, which is Barracuda's own mitigation and blocks both flaws.
• On ESG appliances whose interface was exposed, review admin logins and configuration changes since late October.

Our catalogue lists 11 email security software products.

Sources

• Barracuda Trust Center: pre-authentication authorization bypass and command injection, 2 November 2026
• NCSC (Netherlands): vulnerabilities in Barracuda Email Security Gateway and other products (Dutch), 4 November 2026
• heise online: Barracuda root vulnerability threatens Email Security Gateway (German), 4 November 2026