Barracuda ESG: pre-auth bypass chains with root command injection across six product lines

What happened

On 2 November 2026 Barracuda disclosed two vulnerabilities in its security appliances that, when chained, let an attacker bypass authorization controls and obtain root access on the device.

The first, CVE-2026-116606, is a pre-authentication authorization bypass in the Email Security Gateway (ESG). It carries a CVSS score of 9.3. It lets an attacker modify an appliance's global configuration.

The second, CVE-2026-111560, is a command injection flaw with a CVSS score of 8.6. It lets a user with admin permissions inject OS commands that run as root. It affects six product families.

Barracuda labels both flaws "High" in its advisory despite the first scoring 9.3. The advisory also states that exploitation requires access to the administrative interface. There is a known inconsistency: Barracuda calls CVE-2026-116606 a pre-authentication bypass yet lists "Authentication Required: Yes, administrative access." The published details do not clearly settle whether valid admin credentials are needed in every case. Treat the chain as potentially unauthenticated root until Barracuda clarifies.

The advisory does not report active exploitation and names no campaign. No exploit payloads, example requests or indicators of compromise have been published.

Timeline

• 2 Nov 2026: Barracuda discloses both CVEs and releases patches.
• 3 Nov 2026: Public reporting begins.
• 4 Nov 2026: No active exploitation reported.

Am I affected?

Check which Barracuda products you run and against which flaw.

• Email Security Gateway (ESG): affected by both CVE-2026-116606 and CVE-2026-111560.
• Load Balancer ADC: affected by CVE-2026-111560 only.
• Message Archiver (BMA): CVE-2026-111560 only.
• WAF Control Center (WCC): CVE-2026-111560 only.
• Web Application Firewall (WAF): CVE-2026-111560 only.
• Web Security Gateway (WSG): CVE-2026-111560 only.

Only ESG is listed as vulnerable to the authorization bypass. Your exposure is higher if the appliance's administrative interface is reachable from the internet.

What to do now

1. Confirm whether each appliance's admin interface is reachable from outside trusted internal networks. If it is, restrict it now with network access controls. This is the fastest containment step.
2. Apply the product-specific patch. For ESG on 9.4.017 and later use BNSF-40425; on earlier versions use BNSF-40430. For ADC and WAF use BNADC-16586. For Message Archiver use BNMA-32468. For WAF Control Center use BNWF-60060. For Web Security Gateway use BNYF-24789.
3. Verify the update actually installed. Barracuda notes that systems several firmware versions behind may need multiple updates, and that automatic patching may not have applied the fix.
4. If auto patch did not land, install it manually and re-enable automatic patch delivery where it was disabled.
5. Contact Barracuda Support if you cannot confirm firmware and patch status.

How to hunt

Barracuda has not published any hashes, domains, IP addresses, filenames or detection signatures for these CVEs. There is no confirmed exploit method to hunt against, and the 2023 ESG attacks (CVE-2023-2868, CVE-2023-7102) are separate issues whose methods should not be applied here.

Until indicators exist, focus on access rather than malware:

• Review who and what can reach each admin interface. Pull firewall and proxy logs for connections to management ports from outside trusted ranges.
• Audit admin interface authentication logs for unexpected logins or configuration changes to the appliance's global configuration.
• Watch for unexpected processes or shell activity running as root on the appliances, and for configuration drift.
• Record current firmware and patch IDs so you can prove remediation.

What does not help

• Assuming this is admin-only and can wait. CVE-2026-116606 is described as a pre-authentication bypass, and chained with the command injection the result may be root.
• Applying 2023 ESG recovery or detection methods. Those flaws and their malware are not the same issue.
• Relying on auto patch alone. Confirm the update installed on every device.

Sources

• Barracuda warns of critical flaws allowing root access to devices, BleepingComputer, 3 Nov
• Barracuda Flaws Could Be Chained to Bypass Authorization and Gain Root Access, The Hacker News, 3 Nov
• Critical Barracuda Security Flaws Could Let Hackers Bypass Authentication and Gain Root Access, Cyber Security News, 4 Nov