- November 3, 2026
Critical Authentication Bypass in Barracuda Email Security Gateway (CVE-2026-116606, CVE-2026-111560)
A critical Barracuda Email Security Gateway authentication bypass lets unauthenticated attackers overwrite appliance configuration, and chains with a separate command injection flaw to reach root access
Executive Summary
On November 2nd, 2026, Barracuda Networks disclosed CVE-2026-116606, a critical vulnerability in its Email Security Gateway (ESG) appliance which allows an unauthenticated remote attacker to restore a crafted configuration backup to an ESG appliance and overwrite its global configuration. Barracuda disclosed this vulnerability alongside CVE-2026-111560, a command injection flaw in code shared across several Barracuda appliances. Barracuda warns that the two flaws chained together allow an attacker to bypass authorization controls and obtain root access to the device. Barracuda has released fixes for all affected products.
Barracuda ESG is an email filtering appliance that sits in the mail flow of the organizations it protects, giving it visibility into inbound and outbound email. ESG appliances have a history of being targeted by capable threat actors. In 2023, the China-nexus group UNC4841 exploited two ESG zero-days (CVE-2023-2868 and CVE-2023-7102) in a cyber-espionage campaign that deployed backdoors and stole data, and almost a third of the compromised appliances belonged to government agencies.
Although active exploitation has not been reported at the time of writing, Email Security Gateway appliances have historically been targeted soon after vulnerabilities become known. Beazley Security recommends affected organizations apply available fixes as soon as possible and restrict access to appliance administrative interfaces.
Affected Systems or Products
Product | Affected Versions | Patch |
|---|---|---|
Barracuda Email Security Gateway (ESG) | < 9.4.0.030 | BNSF-40425 (9.4.017+), BNSF-40430 (<9.4.017) |
Barracuda Load Balancer Application Delivery Controller (ADC) | < 6.4.0 | BNADC-16586 |
Barracuda Web Application Firewall (WAF) | < 11.0.1 | BNADC-16586 |
Barracuda Web Security Gateway (WSG) | < 16.1.100.100 | BNYF-24789 |
Barracuda Message Archiver (BMA) | < 5.5.4.0 | BNMA-32468 |
Barracuda WAF Control Center (WCC) | < 2.2.1 | BNWF-60060 |
Mitigations / Workarounds
Upgrading to non-vulnerable firmware is the primary remediation. For ESG appliances, a single upgrade to version 9.4.0.030 or greater addresses both CVE-2026-116606 and CVE-2026-111560. The other listed Barracuda products are affected only by CVE-2026-111560 and should also be updated, since that flaw provides the root-level step of the attack chain.
Barracuda notes that appliances running firmware several versions behind may need more than one update to reach a fixed release. Given both flaws require access to the appliance's administrative interface, we advise restricting access to administrative interfaces to trusted internal networks, if fixes cannot be applied immediately in order to reduce exposure.
Patches
Barracuda has released security patches for all affected products. Specific instructions for individual products are listed in the Barracuda Campus article for these vulnerabilities.
Technical Details
At the time of writing, Barracuda has published limited technical detail, and no public proof-of-concept exploit is known to exist.
CVE-2026-116606 is an authentication bypass in the ESG administrative interface. An unauthenticated attacker reaches a configuration-import function through an alternate path that skips the normal login check. The attacker then restores a crafted but compatible backup archive. The appliance accepts it and replaces its global configuration with attacker-controlled settings.
That configuration control is what makes CVE-2026-111560 a viable attack chain candidate. CVE-2026-111560 is an OS command injection flaw in the timezone configuration field of shared Barracuda appliance code. The field does not neutralize shell metacharacters, so a crafted timezone value executes commands with root privileges when the appliance processes it. On its own, the flaw requires administrator access. Chained with CVE-2026-116606, an attacker with network access to the ESG administrative interface can go from no credentials to full root control of the appliance.
How Beazley Security is responding
Beazley Security is monitoring client perimeter devices through our Exposure Management Platform to identify impacted devices and support organizations in remediation of any issues found.
We are also conducting threat hunts across our MDR environment to detect potential exploitation attempts against our clients.
If you believe your organization may have been impacted by this attack campaign and need support, please contact our Incident Response team.
