Barracuda fixes flaws that could give attackers appliance root access

Barracuda Networks released security fixes on 2 November 2026 addressing two high-risk vulnerabilities across multiple Barracuda ESG and related appliance products. When chained, the flaws could enable an attacker to bypass authorization and achieve root access to the device, potentially exposing sensitive email and web traffic. The advisory notes that no active exploitation in the wild has been observed and no public PoC code has been released to date.

The vulnerabilities are tracked as CVE-2026-116606 (Authentication Bypass Allows Global Configuration Restore in Barracuda Email Security Gateway) and CVE-2026-111560 (OS Command Injection in Barracuda Appliances), with CVSSv4 scores of 9.3 and 8.6 respectively. Patches are available, and administrators are urged to update to version 9.4.0.030 where applicable.

Mandiant researchers discovered the flaws in the core firmware, targeting the web management screen of affected appliances. CVE-2026-116606 enables an unauthenticated attacker to call an import function to restore a custom backup file, altering core device settings without login credentials. CVE-2026-111560 stems from poor input validation on the timezone field, causing the system to execute shell commands as root when processing a malicious string.

Barracuda states that exploitation requires access to the product’s administrative interface. Affected products include Email Security Gateway versions prior to 9.4.0.030 for CVE-2026-116606, and a broader range including Email Security Gateway, Web Application Firewall, Load Balancer ADC, Message Archiver, Web Security Gateway and WCC for CVE-2026-111560. Administrators should apply the patches promptly and restrict web admin access to private networks.