CVE-2026-116606 and CVE-2026-111560: Barracuda patches root-access chain in ESG, WAF and more

Barracuda Networks has patched two vulnerabilities, CVE-2026-116606 and CVE-2026-111560, that can be chained to give an attacker root access on its Email Security Gateway (ESG) appliances. Five other Barracuda products are exposed to the second flaw alone. The company published its advisory on 2 November 2026, and BleepingComputer reported it on 3 November. Both flaws require access to the appliance's administrative interface, so the practical question for administrators is whether that interface can be reached from the internet, and whether the patch has been applied.

Key points

• CVE-2026-116606 is a pre-authentication authorization bypass that affects only the Email Security Gateway; Barracuda lists it with a CVSS score of 9.3.
• CVE-2026-111560 is a command injection flaw that affects six products (ESG, Load Balancer ADC, Message Archiver, WAF Control Center, Web Application Firewall and Web Security Gateway); Barracuda lists it with a CVSS score of 8.6.
• Used together, the two flaws can let an attacker bypass authorization controls and obtain root access to the device, according to Barracuda.
• Both require access to the product's administrative interface. Barracuda's advisory does not say either flaw is being exploited, and BleepingComputer's report does not either.
• Patches have been released for every affected product; Barracuda tells customers to restrict administrative access to trusted internal networks.

What to do

Who is affected. Barracuda's advisory lists these products and the patch for each:

Product	CVE-2026-116606	CVE-2026-111560	Patch
Email Security Gateway (ESG)	Yes	Yes	BNSF-40425 (firmware 9.4.017 and later), BNSF-40430 (earlier than 9.4.017)
Load Balancer ADC	No	Yes	BNADC-16586
Message Archiver (BMA)	No	Yes	BNMA-32468
WAF Control Center (WCC)	No	Yes	BNWF-60060
Web Application Firewall (WAF)	No	Yes	BNADC-16586
Web Security Gateway (WSG)	No	Yes	BNYF-24789

How to fix it.

1. Check the firmware version your device reports. Barracuda says the device shows the latest firmware version available, and that a device several versions behind may need more than one update.
2. If the patch has not been applied automatically, apply the one in the table for your product. Guidance for applying patches and updating firmware is on Barracuda Campus, according to the advisory.
3. If automatic patching is turned off, Barracuda recommends setting devices to receive patches automatically.
4. Take the administrative interface off the public internet. Barracuda says organizations whose administrative interfaces are not publicly reachable are less exposed, and recommends restricting access to trusted internal networks with network access controls.
5. For help checking a firmware version or applying a patch, Barracuda points customers to support@barracuda.com.

How to check whether you are exposed. The two things the advisory makes decisive are the firmware or patch level and whether the admin interface answers from outside your network. A device that is both patched and reachable only from an internal management network is in the best position the advisory describes. We have no indicators of compromise from Barracuda for these CVEs, so we cannot offer a reliable way to tell whether a device was already abused; the advisory does not publish one, and Barracuda directs customers to its support team.

What happened

On 2 November 2026 Barracuda published an advisory titled "Pre-Authentication Authorization Bypass and Command Injection Vulnerabilities in Certain Barracuda Products". It describes two flaws. The first, CVE-2026-116606, is an authorization bypass in the Email Security Gateway. The second, CVE-2026-111560, is a command injection flaw that lets an attacker with administrative permissions run operating system commands as root. It is present in the ESG and in five other products.

The advisory's wording about impact is careful. Exploitation requires that an attacker has access to the administrative interface of an affected product. If the two flaws are exploited in combination, the advisory says, an attacker could bypass authorization controls and obtain root access to the device. The advisory says Barracuda "immediately initiated a comprehensive remediation process and released security patches", and the table above lists the fixes.

BleepingComputer's report on 3 November describes CVE-2026-116606 as critical and notes that it lets attackers modify an appliance's global configuration. It adds that CVE-2026-111560 requires admin permissions. The report does not say either flaw has been exploited, and Barracuda's advisory does not either. Neither source we read names who found the flaws.

The numbers

Barracuda's advisory gives a CVSS score and a severity word for each flaw, and the two do not line up neatly. It labels both "High", while CVSS 9.3 falls in the band that the standard calls Critical (9.0 to 10.0). BleepingComputer calls CVE-2026-116606 critical. The advisory's own score is the number to quote; we use "critical" only where we are describing BleepingComputer's wording. The advisory also lists "Authentication Required: Yes, administrative access" for both flaws.

CVE-2026-116606 (ESG)9.3

CVE-2026-111560 (six products)8.6

CVSS scores listed in Barracuda's advisory (CVSS score)

	CVSS score
CVE-2026-116606 (ESG)	9.3
CVE-2026-111560 (six products)	8.6

Source: Barracuda Networks security advisory, 2 November 2026

The spread of products is the other number worth keeping in mind: one flaw touches a single product line, while the other touches six. An organization running a Barracuda web application firewall and a mail gateway needs two different patch identifiers.

Background

Barracuda's email gateway has been a repeat target. In 2023 a China-linked group that Mandiant tracks as UNC4841 exploited a zero-day in the ESG, CVE-2023-2868. Barracuda later said the flaw had been abused since at least October 2022, to deploy malware families called SeaSpy and Saltwater. Barracuda also patched CVE-2023-7102, another ESG flaw that UNC4841 used in zero-day attacks. Per Mandiant, almost a third of the appliances compromised in the 2023 campaign belonged to government agencies. All of this comes from BleepingComputer's recap; we did not re-verify it against Mandiant's original reports for this article.

That history is context, not evidence about the new flaws. Nothing in Barracuda's advisory or BleepingComputer's report links CVE-2026-116606 or CVE-2026-111560 to that group or to any attack. We mention the 2023 campaign because it shows what an attacker with root on a mail gateway can reach: the appliance sits on the edge of the network and handles all inbound mail.

For readers who track edge-device flaws, our earlier coverage of an Ivanti Connect Secure exploit chain and of Synology urging DSM updates after ransomware attacks shows the same pattern: management interfaces on network appliances, left reachable, are what attackers go for.

What it means

For administrators of Barracuda appliances, the work is small and concrete: confirm the patch, and check whether the management interface faces the internet. The advisory's phrase "pre-authentication" can mislead. The advisory's type label is "Pre-Authentication Authorization Bypass", but it also says the attacker needs access to the administrative interface. The risk is therefore concentrated in deployments where that interface is exposed, for example for remote management, or where an attacker already has a foothold on the internal network.

For organizations with several Barracuda products, the second flaw means one product's exposure is not the whole picture. The command injection issue reaches the load balancer, the archiver, both web application firewall products and the web security gateway. Teams that patched the mail gateway first should not assume the rest were covered by the same update; the table shows separate patch IDs, and the Load Balancer ADC and the WAF share one.

For defenders more broadly, the chain illustrates why "requires admin access" is not the same as "safe". An authorization bypass turns a lower-privileged or unauthenticated position into an admin one, and a command injection then turns admin into root. Barracuda's own description is that the two together allow root access.

What we don't know yet

• Exploitation. Neither the advisory nor BleepingComputer's report says the flaws are being exploited. The copy of CISA's Known Exploited Vulnerabilities catalog we checked was released on 30 October, before the advisory, so it cannot tell us anything about these two CVEs; we treat exploitation as unconfirmed.
• Who reported the flaws and when. The advisory does not credit a researcher in the text we read.
• Technical details. Barracuda has not described how the bypass works.
• Independent records. The National Vulnerability Database pages for both CVEs, linked by BleepingComputer, did not load usable content for us, so the scores quoted here are Barracuda's.
• Indicators of compromise. None are published, so there is no public way to hunt for prior abuse.

What to watch next

Watch Barracuda's advisory page for updates, since it lists an "Advisory Updated" date of 2 November. Watch for the NVD records to fill in with independent scoring, and for any exploitation report or CISA catalog entry, which would change the urgency from "patch this week" to "patch now and check for compromise". If you run the affected products and cannot patch immediately, the one control the advisory gives is to restrict admin interface access to trusted networks.

Sources

• Barracuda Networks: Pre-Authentication Authorization Bypass and Command Injection Vulnerabilities in Certain Barracuda Products (primary, published 2 November 2026)
• BleepingComputer: Barracuda warns of critical flaws allowing root access to devices (3 November 2026)
• NVD: CVE-2026-116606 and CVE-2026-111560 (records referenced by BleepingComputer)