Barracuda Vulnerability CVE-2026-116606: Email Gateway Authorization Bypass Chains to Root, What Is Confirmed and the Patches to Check

Barracuda has patched two flaws in its email security, web security, web application firewall, load balancer and archiving appliances. Used together, they could let an attacker get past the appliance's authorization checks and take root, which is full control of the device. If your company's email runs through a Barracuda Email Security Gateway, or your website sits behind a Barracuda Web Application Firewall, confirm the patch this week and make sure the admin page cannot be reached from the internet.

Barracuda published its advisory on Monday, November 2, 2026. Mandiant, which assigned the CVE numbers, published its records the same day. The two sources disagree on one important detail: whether the attacker needs a login at all. We explain that below rather than pick a side.

What Barracuda disclosed

The advisory covers two CVEs:

• CVE-2026-116606, which Barracuda calls a "pre-authentication authorization bypass". It affects only the Email Security Gateway (ESG). CVSS 4.0 score: 9.3.
• CVE-2026-111560, a command injection flaw. It affects six products: ESG, Load Balancer ADC, Message Archiver, WAF Control Center, Web Application Firewall and Web Security Gateway. CVSS 4.0 score: 8.6.

Barracuda's summary: "If exploited in combination, these vulnerabilities could allow an attacker to bypass authorization controls and obtain root access to the device."

What each Barracuda flaw does

According to the CVE records and Mandiant's reports:

• CVE-2026-116606 lets an attacker call the ESG's configuration import function and restore "a crafted, compatible backup archive". The result is an unauthorized change to the appliance's global configuration. The record lists ESG versions earlier than 9.4.0.030 as affected.
• CVE-2026-111560 is a timezone setting that does not filter shell characters. An administrator who is logged in can put operating system commands in that field, and they run as root.

Neither Barracuda nor Mandiant has published a step-by-step account of how the two flaws chain together.

Does the attacker need a login? The sources disagree

This is the key open question, and the primary sources give different answers.

• Barracuda's advisory lists "Authentication Required: Yes, administrative access" for both CVEs. It also says: "Successful exploitation requires an attacker to have access to the administrative interface of an affected product."
• Mandiant's CVE record and report for CVE-2026-116606 describe it as exploitable by "an unauthenticated remote attacker". The CVSS vector says no privileges are required (PR:N).

For CVE-2026-111560 the two sources agree: it needs an administrator login.

One possible reading is that Barracuda's "access to the administrative interface" means being able to reach the admin page over the network, not holding a password. That would fit the word "pre-authentication" in Barracuda's own advisory title. But Barracuda's table plainly says administrative access is required, and as of November 3 neither company has publicly resolved the conflict. We do not know which description is correct. The safe plan: assume anyone who can reach your ESG admin page could attempt CVE-2026-116606.

The severity labels differ too

Barracuda's table labels both flaws High. A CVSS 4.0 score of 9.3 falls in the band the CVSS standard calls Critical (9.0 to 10.0). Mandiant rates the exploitability of CVE-2026-116606 as High and CVE-2026-111560 as Medium, because the second one needs an admin login.

What is confirmed and what is not

Barracuda patches to check this week

A note on version numbers: Barracuda writes the ESG firmware as "9.4.017", while the CVE records use the format 9.4.0.27 and 9.4.0.030. For the other products, Barracuda lists patch IDs rather than fixed firmware numbers. If you can't tell whether a device is covered, contact Barracuda Support.

Checklist for this week

1. List every Barracuda appliance you run, physical, virtual or cloud-hosted, including any that an outside IT provider manages for you.
2. Check firmware and patch status in each device's admin interface. Barracuda says the device shows the latest available firmware. A device several versions behind may need more than one update.
3. Apply the patch by hand if it was not applied automatically. If automatic patching is turned off, Barracuda recommends turning it back on.
4. Take the admin interface off the internet. Barracuda recommends limiting it to trusted internal networks and using network access controls. If staff manage it remotely, put it behind a VPN.
5. Look for configuration changes you did not make. This is our advice, not Barracuda's. CVE-2026-116606 works by restoring a crafted configuration backup, so check admin accounts, mail routing, relay settings and allowed IP lists against what you expect.
6. Save a known-good configuration backup after patching, so you have something to compare against later.
7. Watch for updates. If Barracuda revises its advisory, or CISA adds either CVE to its Known Exploited Vulnerabilities catalog, the urgency goes up.

Why it matters for a business network

An email security gateway sees every message coming in and going out of the company. A web application firewall sits in front of your website or customer portal. Root on either one means an attacker could read or redirect mail, weaken filtering, or use the box as a trusted foothold inside your network. These devices are trusted by everything around them, and often nobody watches them closely once they are installed.

Barracuda's ESG has been through this before. In 2023, attackers exploited CVE-2023-2868 on ESG appliances, and Barracuda went on to say: "Compromised ESG appliances must be immediately replaced regardless of patch version level." Nothing published so far suggests the new flaws are being exploited that way. Still, that history shows what is at stake when a gateway appliance falls behind on patches. If you want help reviewing the appliances at your network edge, our security hardening work covers exactly that, and our self-hosting and infrastructure service covers the servers behind them.

Barracuda vulnerability questions people are asking

Is CVE-2026-116606 being exploited?

Barracuda's advisory does not say it is. The CISA assessment attached to the CVE record listed exploitation as "none" when it was recorded. That can change, so patch now rather than waiting.

Does CVE-2026-116606 need a password?

The sources disagree. Mandiant says an unauthenticated remote attacker can exploit it. Barracuda's table says administrative access is required. Until that is cleared up, treat network access to the admin page as the risk.

Am I safe if the Barracuda admin page is not on the internet?

You are at lower risk. Barracuda says organizations whose admin interfaces are not reachable from the internet are less exposed. Lower is not zero: an infected PC inside your network can still reach the admin page, so patch anyway.

Which Barracuda products are affected?

Email Security Gateway is affected by both flaws. Load Balancer ADC, Message Archiver, WAF Control Center, Web Application Firewall and Web Security Gateway are affected by CVE-2026-111560 only. Barracuda CloudGen Firewall is not on the advisory's list.

What is the fixed Barracuda ESG version?

Barracuda lists patch BNSF-40425 for firmware 9.4.017 and later, and BNSF-40430 for earlier firmware. The CVE record treats ESG versions earlier than 9.4.0.030 as affected by CVE-2026-116606.

Do automatic updates cover this?

They may. Barracuda says to apply the patch by hand if it was not applied automatically, and to turn automatic patching back on if it is off. Check each device rather than assuming.

The bigger lesson

Security appliances are software too. They need an owner, an inventory and a patch routine, and their admin pages belong on a private network, not the open internet. When the vendor and the CVE record disagree about how bad a flaw is, plan for the worse reading.

If you want a second set of eyes on your firewalls, gateways and servers, see security hardening or request a quote.

Get security alerts like this by email, with our free checklist, at security alerts.

Sources: Barracuda security advisory; Mandiant MNDT-2026-0042 (CVE-2026-116606); Mandiant MNDT-2026-0041 (CVE-2026-111560); Barracuda 2023 ESG vulnerability notice.