Barracuda Patches Two Admin-Interface Flaws That Combine for Root Access on ESG

Barracuda published an advisory on 2 November for two vulnerabilities in its products, and says that “if exploited in combination” they could let an attacker bypass authorization controls and obtain root access to the device.

CVE-2026-116606, a pre-authentication authorization bypass rated 9.3, affects the Email Security Gateway (ESG) only. CVE-2026-111560, a command injection rated 8.6, affects ESG plus the Load Balancer ADC, Message Archiver, WAF Control Center, Web Application Firewall and Web Security Gateway. Barracuda says “successful exploitation requires an attacker to have access to the administrative interface of an affected product,” and lists authentication required as “Yes, administrative access” for both. The advisory does not report exploitation.

Patches are listed per product: BNSF-40425 for ESG on 9.4.017 or later and BNSF-40430 for earlier builds, BNADC-16586 for the Load Balancer ADC and the WAF, BNMA-32468 for Message Archiver, BNWF-60060 for WAF Control Center and BNYF-24789 for Web Security Gateway. Barracuda says a device “multiple versions out of date” may need more than one firmware update, and that customers who turned off automatic patching should set devices to receive patches again.

The vendor’s guidance on exposure is specific: restrict access to administrative interfaces to trusted internal networks and use network access controls to limit exposure. Organizations whose interfaces are not publicly reachable “are less exposed to this attack path.”

The command injection reaches six products, so the inventory question is wider than the mail gateway. A team that patched ESG alone has left the other five on the list. In our reading, the first check is a scan of which Barracuda administrative interfaces answer from outside the management network, since that answer sets the real urgency. Gateways have drawn this kind of attention before, as in Cisco’s Secure Email Gateway flaw under active exploitation, and the exposure question matches the one raised when Palo Alto Networks updated PAN-OS for a management interface flaw.

Source: Barracuda, advisory on CVE-2026-116606 and CVE-2026-111560