Vulnerabilities
Barracuda ESG flaw chain gives attackers root
CVE-2026-116606 and CVE-2026-111560 chain to root on Barracuda Email Security Gateway, and the second flaw hits five more products. Patch IDs and checks.
On November 2, Barracuda published an advisory for two flaws that, used together, give an attacker root on its Email Security Gateway (ESG). CVE-2026-116606 (CVSS 4.0 score 9.3) lets an attacker restore a crafted backup and change the appliance's global configuration. CVE-2026-111560 (CVSS 8.6) is a command injection in the time zone setting that runs as root. Barracuda's own wording: "If exploited in combination, these vulnerabilities could allow an attacker to bypass authorization controls and obtain root access to the device."
The command injection is not limited to ESG. It also affects Load Balancer ADC, Web Application Firewall (WAF), WAF Control Center (WCC), Web Security Gateway (WSG) and Message Archiver (BMA). As of November 3 there were no reports of exploitation and no public proof of concept, so the work is to patch and then confirm nothing was changed. ESG still goes to the front of the queue because of its history, covered below.
How it works
ESG, like most appliances, can export its settings to a backup archive and import that archive again, for example after a hardware swap. That import changes the whole device configuration, so it should only be reachable by a logged-in administrator. In ESG versions before 9.4.0.030, the configuration import function does not enforce that check. Mandiant, which published the CVE records, describes CVE-2026-116606 as an authentication bypass (CWE-288, a sensitive function reachable through an alternate path) in which an unauthenticated remote attacker restores a crafted, compatible backup and rewrites the global configuration.
The second flaw sits in code shared across Barracuda's appliance line. The time zone field in the system settings is later passed to a process that runs it in a shell as root, and shell metacharacters such as backticks, semicolons and $( ) are not filtered out (CWE-78, OS command injection). On its own, CVE-2026-111560 needs administrator access. On ESG, the first flaw removes that need: the attacker can plant settings through the import, then get a command into the time zone value and wait for the system to process it.
The sources disagree on one point. Barracuda's advisory title calls the ESG flaw "pre-authentication", and Mandiant's record scores it with no privileges required, but the advisory's own summary lists "Authentication Required: Yes, administrative access". Both agree that the attacker must be able to reach the administrative web interface. Treat any ESG whose admin interface is reachable from untrusted networks as exposed until it is patched.
What attackers are doing
Nothing has been reported so far. Neither Barracuda nor Mandiant mentions exploitation, and neither CVE was in CISA's Known Exploited Vulnerabilities (KEV) catalog when the advisory went out.
The product's history argues for speed anyway. In 2023 a China-linked group that Mandiant tracks as UNC4841 exploited CVE-2023-2868, a command injection in the ESG module that screens email attachments, from at least October 2022, and Mandiant reported that almost a third of the compromised appliances belonged to government bodies. Barracuda ended up telling affected customers to replace the hardware rather than trust a patch, and later fixed another ESG flaw, CVE-2023-7102, that the same group had used. A root-level chain on the same appliance, now documented in public CVE records, is the kind of thing that group has acted on before.
What to do
1. Confirm each appliance has the fix
Barracuda ships these fixes as product patches that apply automatically by default. Do not assume they landed: check each device. The patch IDs are BNSF-40425 for ESG on 9.4.017 and later, BNSF-40430 for ESG below that, BNADC-16586 for Load Balancer ADC and WAF, BNWF-60060 for WAF Control Center, BNYF-24789 for Web Security Gateway and BNMA-32468 for Message Archiver. For ESG, the CVE record gives 9.4.0.030 as the first release without the import flaw.
If someone turned automatic patching off, turn it back on, and apply the patch by hand where it has not arrived. Barracuda notes that a device several firmware versions behind may need more than one update to reach a fixed build, so plan for several reboots on older units. The version thresholds in Mandiant's records for the command injection are ESG 9.4.0.27 and earlier, ADC 6.4.0 and earlier, WAF 11.0.1 and earlier, WCC 2.2.1 and earlier, WSG 16.1.100.100 and earlier, and BMA 5.5.4.0 and earlier.
2. If you cannot patch today
Restrict the administrative web interface to a management network or a short list of admin workstations, using the upstream firewall rather than the appliance itself. Barracuda points out that products whose admin interface is not exposed to the internet carry lower risk. That cuts down who can try. Anyone already on an allowed network can still use both flaws, so treat the filter as a stopgap until the patch is confirmed.
3. Check whether anything was changed
Barracuda and Mandiant have not published indicators of compromise, so the checks below compare the appliance against what it should look like:
- Review the configuration backup and restore history on ESG for any import you cannot match to a change ticket.
- Export the current global configuration and diff it against a backup taken before November 2. Look closely at admin accounts, allowed admin IP ranges, mail routing and relay settings.
- Read the time zone value on every affected appliance. A real value is a zone name such as
Europe/London. Anything with backticks, semicolons, pipes or$(is an injection attempt. - Compare admin session activity against successful logins. A configuration change with no matching login is a red flag.
A failed attempt may leave nothing behind. If an admin interface was reachable from the internet, go through all four checks, whatever the logs show.
4. If you find tampering
Treat root on an email gateway as a compromise of the mail it handled. Rebuild or restore from a clean configuration, then rotate the appliance's admin passwords, any LDAP or Active Directory bind account it uses, SMTP relay credentials, API keys and the TLS private keys on the device. Given how persistent UNC4841's ESG implants were in 2023, open a case with Barracuda support before returning the device to service.
The wider lesson
Appliance management interfaces keep showing up as the entry point in these advisories. Putting them on a management network the day a device is installed removes most of the exposure before any CVE is published. The command injection here also shows why a "needs admin" rating is weaker than it looks. Shared code across six products means one admin-only bug becomes a root chain the moment any of those products has an authentication gap.
Our network penetration tests check which appliance admin interfaces can be reached from where, and our safeguarding and hardening work locks them down to management networks. Open the chat and Yaali, our AI agent, will pass your question to the engineer who would do the work.
Sources: Barracuda security advisory, Mandiant MNDT-2026-0041, Mandiant MNDT-2026-0042, BleepingComputer, Field Effect, Ostorlab, Guardian MSSP.