Barracuda Patches Two Flaws That Could Give Hackers Root Access

Two vulnerabilities in Barracuda's Email Security Gateway could give attackers root-level control of affected appliances by combining an authorization bypass with command injection.

Barracuda Networks released security patches on November 2, 2026, for CVE-2026-116606 and CVE-2026-111560. Six product families are affected, but only the Email Security Gateway (ESG) is vulnerable to both flaws, creating a potential attack path from unauthorized configuration changes to privileged command execution.

In its security advisory, Barracuda said exploitation requires network access to an affected appliance's administrative interface. The company recommends restricting management access and verifying that applicable security patches are installed.

How the Barracuda flaws could lead to root access

CVE-2026-116606 is a pre-authentication authorization bypass affecting ESG. An unauthenticated remote attacker could restore a crafted, compatible backup archive through a configuration-import function, modifying the appliance's global settings without authorization. The vulnerability has a critical CVSS v4.0 score of 9.3, according to Mandiant's technical disclosure.

CVE-2026-111560 is a command injection vulnerability involving improper handling of shell metacharacters in the timezone configuration field. An authenticated administrator could inject commands that execute with root privileges when the modified value is processed. Mandiant's separate disclosure assigns it a high-severity CVSS v4.0 score of 8.6.

Chaining the flaws could give attackers root-level control of ESG. Separately, attacks against Cisco firewall management infrastructure have demonstrated how compromised security administration systems can expose credentials and internal networks. As of November 5, 2026, neither Barracuda vulnerability had been linked to publicly confirmed exploitation.

Affected Barracuda products and security patches

The authorization bypass affects only ESG. The command injection flaw affects five additional product families, where exploitation independently requires administrative privileges.

Barracuda has released these patches:

Barracuda's ESG update documentation identifies firmware 9.4.0.029 or later as patched, while Mandiant lists versions earlier than 9.4.0.030 as vulnerable. Administrators should confirm that applicable security patches are installed and contact Barracuda Support if the conflicting version guidance leaves their devices' protection status uncertain.

Prioritizing vulnerabilities by exploitability and exposure can help identify which appliances need immediate attention. Security teams should:

• Verify security patches: Confirm installation and enable automatic updates where appropriate. Older firmware may require sequential upgrades.
• Restrict management access: Keep administrative interfaces off the public internet, segment management networks, and limit access to trusted systems.
• Strengthen administrative controls: Enforce least-privilege permissions and multifactor authentication where supported. MFA does not prevent the authentication bypass.
• Monitor suspicious activity: Investigate unusual configuration imports, backup restores, timezone changes, unfamiliar accounts, and unexpected outbound connections.
• Validate configuration integrity: Compare settings against known-good baselines and maintain secure configuration backups.
• Test incident response plans: Preserve logs and verify procedures for investigating, isolating, and recovering potentially compromised appliances.

Previous attacks involving bypassed WAF protections and unpatched enterprise software demonstrate the limits of network defenses. Barracuda customers should confirm patch installation and restrict management access to reduce exposure to the disclosed attack chain.

Read more: An exploited Check Point management-server zero-day highlights how vulnerabilities in security administration infrastructure can expose organizations to unauthorized code execution.