Barracuda warns of critical flaws that chain to root access on Email Security Gateway and other appliances

What happened

• 3 November 2026: BleepingComputer reported that Barracuda warned of two flaws that, combined, “could allow an attacker to bypass authorization controls and obtain root access to the device” (BleepingComputer).
• CVE-2026-116606 affects only the Email Security Gateway. BleepingComputer describes it as an ESG authentication weakness that lets attackers modify the appliance’s global configuration and labels it critical (BleepingComputer). GBHackers describes the same CVE as a pre-authentication authorization bypass, carrying CVSS 9.3, in which an unauthenticated attacker invokes the configuration-import function and restores a crafted backup archive (GBHackers).
• CVE-2026-111560 is a command injection that lets a threat actor with admin permissions run OS commands as root. It affects ESG, Load Balancer ADC, Message Archiver, WAF Control Center, Web Application Firewall, and Web Security Gateway. GBHackers gives it CVSS 8.6 (BleepingComputer; GBHackers).
• Both outlets note that administrative interface access is still a prerequisite for the command injection; chaining the configuration flaw is what supplies the unauthorized access (BleepingComputer; GBHackers).
• Neither outlet reports that either 2026 CVE has been exploited in the wild. BleepingComputer recalls earlier, separate ESG flaws (CVE-2023-7102 and CVE-2023-2868) abused by the UNC4841 group, and GBHackers states those historical incidents do not establish exploitation of the newly disclosed flaws (BleepingComputer; GBHackers).

Where the two outlets disagree. BleepingComputer frames CVE-2026-116606 as an “authentication weakness” that modifies global configuration, while GBHackers calls it a “pre-authentication authorization bypass” via a configuration-import/backup-restore path (BleepingComputer; GBHackers). They also give the vulnerable ESG firmware differently: GBHackers says the authorization bypass affects versions earlier than “9.4.0.030”, whereas BleepingComputer’s patch guidance splits ESG at firmware “9.4.017” without citing a fixed version string (BleepingComputer; GBHackers). Treat all affected appliances as vulnerable until the relevant patch is confirmed installed. CVSS scores (9.3 and 8.6) are reported only by GBHackers (GBHackers).

Affected products

All patch IDs below are reported by both outlets unless noted (BleepingComputer; GBHackers).

The sources give firmware version ranges only for ESG; no version numbers are provided for the five other product families, only the patch IDs (BleepingComputer; GBHackers).

What to do

1. Apply the patch for every affected product you run, using the patch IDs in the table above (BleepingComputer).
2. Verify both the firmware version and the patch installation status. A firmware update alone does not confirm full remediation (GBHackers).
3. Prioritize ESG appliances with exposed management interfaces, and confirm remediation on every affected appliance (GBHackers).
4. Restrict administrative interface access to trusted internal networks and enforce network access controls, since exploitation requires administrative access. Keeping management interfaces off the public internet reduces exposure but does not replace patching (BleepingComputer; GBHackers).
5. If a device runs substantially outdated firmware, apply multiple sequential updates, with Barracuda support if needed; if automatic patching is disabled or the update has not arrived, apply the relevant fix manually and promptly (GBHackers).

Sources

• BleepingComputer: Barracuda warns of critical flaws allowing root access to devices (3 November 2026)
• GBHackers: Barracuda Email Security Gateway flaws (4 November 2026)