Barracuda ESG Pre-Auth Bypass to Root, Patched (CVE-2026-116606)

TL;DR

• Two flaws in Barracuda appliances let an attacker with access to an administrative interface reach root. CVE-2026-116606 is a pre-authentication authorization bypass in Email Security Gateway. CVE-2026-111560 is a root command injection shared by six product lines. Barracuda disclosed both and shipped patches on November 2, 2026.
• The bypass scores 9.3 Critical, CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N, and Mandiant published the CVE records after Barracuda reported the flaws to it in October 2026.
• No exploitation is known, and neither CVE is in CISA's Known Exploited Vulnerabilities catalog as of November 2, 2026. Barracuda's 2023 ESG flaw CVE-2023-2868 was exploited at scale, so the same appliance line has a live attack history.
• Apply the patches now: BNSF-40425 or BNSF-40430 on ESG, and the product-specific patch on every other affected line. Restrict administrative interfaces to trusted networks if you cannot patch today.

Am I affected?

All of these must hold:

• You run an affected Barracuda appliance: Email Security Gateway, Load Balancer ADC, Message Archiver, WAF Control Center, Web Application Firewall or Web Security Gateway.
• For CVE-2026-116606, only Email Security Gateway is affected, at every version before 9.4.0.030.
• For CVE-2026-111560, the affected ranges are ESG 9.4.0.27 and earlier, ADC 6.4.0 and earlier, BMA 5.5.4.0 and earlier, WCC 2.2.1 and earlier, WAF 11.0.1 and earlier and WSG 16.1.100.100 and earlier. The flaw sits in code common to all six products.
• The attacker needs access to the administrative interface. Barracuda states that successful exploitation requires that access, and that interfaces not reachable from the internet are less exposed.

Barracuda's advisory frames the two flaws as one attack path: the bypass defeats the authorization check, and the command injection turns administrative actions into root code execution. The advisory's patch table names one patch per product, and ESG appears in both CVE columns. The two flaws went from Barracuda's reports to Mandiant to published CVEs, vendor advisory and patches inside 18 days.

Check your firmware version in the appliance's administrative interface, where the device shows the running firmware version and the latest available. Barracuda notes that devices multiple versions out of date may need more than one update; Barracuda Support can verify the version if you are unsure.

How do I fix it?

Apply the patch for your product, then verify the firmware version in the interface.

1. In the administrative interface, check for the product's patch in the update or patch section. ESG receives BNSF-40425 on 9.4.017 and newer, or BNSF-40430 on older builds.
2. If the patch has not been applied automatically, apply it manually. Guidance for manual patch application is on Barracuda Campus.
3. If automatic patching is off, turn it on so future security patches land without a manual step.
4. Confirm the device shows the latest firmware version after the update. Contact Barracuda Support if the version does not advance; devices several versions behind may need staged updates.

Restricting administrative access is the workaround while patching waits. Limit the administrative interface to trusted internal networks and enforce network access controls. This lowers exposure on every affected product, but it does not fix either flaw, and a reachable interface on a trusted network remains a path for anyone on that network.

What is the root cause?

Barracuda has not published per-flaw technical detail beyond the two Mandiant CVE records, so this section reports what those records state.

CVE-2026-116606 is an authentication bypass using an alternate path or channel, CWE-288. An unauthenticated remote attacker invokes a configuration-import function that should require authentication, and restores a crafted, compatible backup archive. The restored archive then modifies the appliance's global configuration. Mandiant rates the exploitability high because the flaw is exposed to an unauthenticated remote attacker.

CVE-2026-111560 is an OS command injection, CWE-78, in the timezone configuration field of common Barracuda code. An authenticated administrator submits shell metacharacters in the timezone value. A later process executes them with root privileges. Six product lines share the common code, which is why one flaw spans the whole table above.

Mandiant's disclosure timeline records Barracuda reporting CVE-2026-111560 on 2026-10-15 and CVE-2026-116606 on 2026-10-22, with both CVEs published on 2026-11-02. The combined chain, bypass then injection, is what Barracuda's advisory describes as an attacker obtaining root access to the device.

How is it exploited?

Barracuda and Mandiant describe the attack path at advisory level, and no public proof of concept exists, so these steps restate their published account rather than a demonstrated exploit.

1. The attacker reaches the administrative interface of an affected appliance. Barracuda states successful exploitation requires this access.
2. On Email Security Gateway before 9.4.0.030, the attacker invokes the configuration-import function without credentials, exploiting CVE-2026-116606. The function accepts a crafted, compatible backup archive.
3. The restored archive changes the appliance's global configuration. Mandiant describes the impact as unauthorized modification of global configuration.
4. With administrative access, whether obtained through the bypass or held legitimately, the attacker submits a timezone value containing shell metacharacters, CVE-2026-111560. A later process runs the injected commands as root.

The chain needs both flaws only when the attacker starts without credentials. An attacker who already holds administrative access reaches the root injection directly through CVE-2026-111560.

How does the attack flow?

One sentence: on Email Security Gateway, an unauthenticated request to the configuration-import function restores a crafted archive that changes global configuration, and the attacker later submits a crafted timezone value that a process executes as root.

What can an attacker do?

The documented impact is root code execution on the appliance and control of its global configuration, under these conditions:

• The attacker can reach the administrative interface over the network. Both CVSS vectors record a network attack vector.
• The pre-authentication bypass applies only to Email Security Gateway before 9.4.0.030. On the other five product lines, the attacker must already hold administrative credentials to reach the injection.
• The command injection needs the crafted timezone value to be processed later, so impact is not instant on submission.

Barracuda's advisory states that exploiting the two flaws in combination could allow an attacker to bypass authorization controls and obtain root access to the device. Neither the advisory nor the CVE records claim a data-breach or lateral-movement capability beyond the appliance itself.

Why does the fix work?

Barracuda ships fixes as closed-source patches, so the patch diff is not public to quote. The advisory's remediation is a firmware patch per product line: ESG takes BNSF-40425 or BNSF-40430, and each other line takes its own named patch. The vendor confirms remediation of both vulnerabilities, but has not published the exact patch mechanism.

The advisory's guidance confirms the patches are the fix: verify devices run the latest firmware, apply the named patch manually if it has not landed automatically, and enable automatic patching. Additional field hardening is not documented.

How do I check if I was compromised?

Neither Barracuda nor Mandiant has published indicators of compromise for these flaws. Use configuration-focused checks on the appliance until guidance arrives.

1. Review the configuration-import and restore history in the administrative interface for imports you cannot account for, on every ESG earlier than 9.4.0.030.
2. Export and diff the global configuration against your last known-good backup, and treat any unexplained change as a lead.
3. Inspect the timezone configuration value on every affected product for strings that are not valid timezone identifiers, including backticks, semicolons, dollar signs or command substitution.
4. Review administrative authentication logs for sessions that reached administrative functions without a matching successful login.

An attempt that failed may leave no trace, because a rejected import or an unprocessed timezone value need not persist anywhere. If your interface was internet-facing, treat a full review as due regardless of what the logs show.

Timeline

• 2026-10-15: Barracuda reports the timezone command injection to Mandiant, recorded as CVE-2026-111560.
• 2026-10-22: Barracuda reports the pre-authentication bypass to Mandiant, recorded as CVE-2026-116606.
• 2026-11-02: Barracuda publishes its advisory with the per-product patch table, and Mandiant releases both CVE records.

FAQ

Why does one command injection affect six products?

The timezone handling lives in code shared across Barracuda appliance lines. Mandiant's record describes "certain Barracuda appliance products using common Barracuda code", so every product that ships the shared component inherits the flaw.

Is the pre-authentication bypass remotely exploitable from the internet?

Only if the administrative interface is reachable from the internet. The CVSS vector records a network attack vector with no privileges and no user interaction. Barracuda's guidance states that organizations whose administrative interfaces are not publicly accessible are less exposed.

How does this compare to the 2023 Barracuda ESG incident?

The 2023 flaw, CVE-2023-2868, was a remote command injection in a .tar file upload path that was exploited at scale. CVE-2026-116606 is a different flaw class, an authentication bypass on a configuration-import function, and no exploitation is known. The comparison matters only as attack history on the same product line.

Do the patches require a reboot or a maintenance window?

Barracuda's advisory does not say. It directs customers to apply the named patch and contact Barracuda Support for assistance verifying firmware or applying patches.

Is there a workaround?

Restricting the administrative interface to trusted internal networks is the exposure reduction Barracuda recommends. It does not fix either flaw; it removes the network path an outside attacker needs.

Find exposed Barracuda appliances with Ostorlab

Ostorlab's attack surface discovery inventories the internet-facing hosts in your ranges, so you can find every Barracuda appliance whose administrative interface is reachable. Check each against the patch table above. Start a scan with Ostorlab to know which devices need the patch first.

References

• Barracuda Networks security advisory, "Pre-Authentication Authorization Bypass and Command Injection Vulnerabilities in Certain Barracuda Products", published November 2, 2026, with the affected-products table, per-product patch identifiers and remediation guidance: https://trust.barracuda.com/security/pre-authentication-authorization-bypass-command-injection (checked November 2, 2026)
• CVE-2026-116606 record, Mandiant's CNA entry, published November 2, 2026, CVSS v4.0 9.3 Critical, CWE-288: https://www.cve.org/CVERecord?id=CVE-2026-116606 (checked November 2, 2026)
• CVE-2026-111560 record, Mandiant's CNA entry, published November 2, 2026, CVSS v4.0 8.6 High, CWE-78: https://www.cve.org/CVERecord?id=CVE-2026-111560 (checked November 2, 2026)
• Mandiant vulnerability disclosure MNDT-2026-0042 for CVE-2026-116606, with the CWE, the CVSS vector and the disclosure timeline: https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2026/MNDT-2026-0042.md (checked November 2, 2026)
• Mandiant vulnerability disclosure MNDT-2026-0041 for CVE-2026-111560, with the six-product affected list and the disclosure timeline: https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2026/MNDT-2026-0041.md (checked November 2, 2026)
• CISA Known Exploited Vulnerabilities catalog record for the 2023 Barracuda ESG flaw CVE-2023-2868, added May 26, 2023, cited here as the product line's attack history: https://www.cisa.gov/known-exploited-vulnerabilities-catalog (checked November 2, 2026)
• CISA Known Exploited Vulnerabilities catalog JSON feed, searched for CVE-2026-116606 and CVE-2026-111560 with no match as of November 2, 2026: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json (checked November 2, 2026)