Barracuda email gateways: two chained flaws give root access and are now exploited

Top-Secured cyber watch: independent analysis based on the sources listed below. Top-Secured is not affiliated with the companies mentioned and will never ask you for your bank details or passwords.

Barracuda says attackers are exploiting two flaws that, combined, give root access to its Email Security Gateway appliances. One of them also affects its WAF, load balancers, archivers and web gateways. CISA added both to its catalogue of exploited vulnerabilities on 10 November and gave federal agencies until 13 November to fix them.

What happened

On 2 November 2026, Barracuda published an advisory on two vulnerabilities, disclosed the same day by Mandiant. On the evening of 9 November, the vendor updated it: it has identified exploitation activity affecting a small number of organisations. The next day, CISA added both flaws to its Known Exploited Vulnerabilities catalogue, with a deadline of 13 November for US federal agencies.

• CVE-2026-116606 (CVSS 9.3), Email Security Gateway (ESG) only: without logging in, an attacker who can reach the administration interface can call the configuration import function and restore a crafted backup, rewriting the appliance’s settings.
• CVE-2026-111560 (CVSS 8.6): an administrator can inject system commands through the timezone field; they run as root. ESG, Load Balancer ADC, Web Application Firewall, Message Archiver, Web Security Gateway and WAF Control Center are affected.

Who is at risk

Chained together, the two flaws let an attacker go from no account at all to root on the appliance, according to Barracuda. Appliances whose administration interface is reachable from the internet are the most exposed. According to Mandiant, affected versions include ESG up to 9.4.0.27, ADC up to 6.4.0, WAF up to 11.0.1, Message Archiver up to 5.5.4.0, Web Security Gateway up to 16.1.100.100 and WAF Control Center up to 2.2.1.

What to do now

1. Check the patch status in each appliance’s interface: Barracuda normally applies these patches automatically (for ESG, BNSF-40425 or BNSF-40430 depending on the firmware). If it is missing, install it by hand and turn automatic patching back on.
2. Update old firmware: an appliance several versions behind may need several successive updates.
3. Close the administration interface to the internet: allow only internal networks or a VPN, and check from an outside connection that the page no longer answers.
4. Look for traces: unexpected configuration changes or restores, odd timezone values, unknown administrator accounts.
5. If in doubt, contact Barracuda support and change every credential stored on the appliance (directory accounts, mail relays, certificates).

Our take

A security appliance is a server, with an administration page that should never face the internet. Automatic patching is a real asset here, provided someone checks that it actually ran. An email gateway sees all your mail: treat it as a critical server.

Sources

• Barracuda — Pre-Authentication Authorization Bypass and Command Injection Vulnerabilities in Certain Barracuda Products
• CISA — Known Exploited Vulnerabilities Catalog: CVE-2026-116606 (Barracuda ESG)
• Mandiant — MNDT-2026-0042: Barracuda ESG authentication bypass (CVE-2026-116606)
• Mandiant — MNDT-2026-0041: Barracuda command injection (CVE-2026-111560)

How we choose, verify and write our analyses →