Barracuda patches two Email Security Gateway flaws that chain to root, one also affecting five other products

TLDR

• Barracuda patched two flaws that, chained, could give root on Email Security Gateway; it says exploitation needs admin interface access.¹³
• CVE-2026-116606 scores CVSS 9.3 and affects only the gateway; CVE-2026-111560 scores 8.6 and affects six products.¹
• Barracuda lists patch IDs per product and advises restricting admin interfaces to trusted internal networks.¹

Barracuda Networks has released security patches for two vulnerabilities, CVE-2026-116606 and CVE-2026-111560, and tells customers to review the affected products, run the latest firmware and apply all security patches.¹ Its advisory is dated 2 November 2026, and BleepingComputer reported the warning on 3 November.¹³ BleepingComputer describes the first as a critical flaw stemming from an Email Security Gateway (ESG) authentication weakness that attackers can exploit to modify an appliance's global configuration, and the second as letting threat actors with admin permissions inject OS commands that run as root.³ Barracuda says successful exploitation requires access to the administrative interface of an affected product, and that, if exploited in combination, the flaws could let an attacker bypass authorisation controls and obtain root access to the device.¹²

Barracuda's advisory gives CVE-2026-116606 a CVSS score of 9.3 and lists it as affecting ESG only, while CVE-2026-111560 scores 8.6 and affects ESG, Load Balancer Application Delivery Controller (ADC), Message Archiver (BMA), WAF Control Center (WCC), Web Application Firewall (WAF) and Web Security Gateway (WSG).¹ The advisory labels the severity of both as "High", whereas BleepingComputer calls the first flaw critical.¹³ NVD's record for CVE-2026-116606 describes an authentication bypass in ESG versions earlier than 9.4.0.030 that lets an unauthenticated remote attacker invoke a configuration-import function and restore a crafted, compatible backup archive, and lists it as awaiting analysis.⁴ NVD's record for CVE-2026-111560 describes improper neutralisation of shell metacharacters in the timezone configuration field, which lets an authenticated administrator inject OS commands that run with root privileges, in ESG up to 9.4.0.27, ADC up to 6.4.0, WAF up to 11.0.1, WSG up to 16.1.100.100, BMA up to 5.5.4.0 and WCC up to 2.2.1.⁵

The sources differ on two points. Barracuda's advisory lists "Authentication Required: Yes, administrative access" for CVE-2026-116606, while NVD describes an unauthenticated remote attacker.¹⁴ The Centre for Cybersecurity Belgium describes an unauthenticated attacker with access to the administrative interface, and says the two flaws can most likely be combined, with the first used to insert shell commands into the configuration field that the second then runs as root.⁶ On firmware, Barracuda Campus says version 9.4.0.029 includes the patches and that ESG appliances should upgrade to 9.4.0.029 or later, whereas NVD and Field Effect give 9.4.0.030 as the first version not affected by CVE-2026-116606.²⁴⁷ The patch IDs in Barracuda's advisory are BNSF-40425 (9.4.017 and later) and BNSF-40430 (earlier than 9.4.017) for ESG, BNADC-16586 for both Load Balancer ADC and WAF, BNMA-32468 for BMA, BNWF-60060 for WCC and BNYF-24789 for WSG.¹

Barracuda says organisations whose administrative interfaces are not publicly accessible from the internet are less exposed, and recommends restricting access to trusted internal networks, turning on automatic patching and, for devices several firmware versions behind, running more than one update.¹ Barracuda Campus adds that appliances below firmware 9.1 must update in two steps.² Field Effect states that no exploitation has been reported in this case, and advises reviewing administrative access logs and configuration restoration activity where an ESG management interface was exposed before patching.⁷ The Belgian centre notes that patching does not remediate a historic compromise.⁶ BleepingComputer recalls that ESG appliances were hit in 2023, when the UNC4841 group exploited CVE-2023-7102 as a zero-day and abused CVE-2023-2868 in cyber-espionage attacks that deployed SeaSpy and Saltwater malware.³

Why it matters: the Email Security Gateway is the only product affected by both flaws and sits in the mail path, so a chain to root would hand an attacker a trusted security device, though Barracuda says exploitation needs access to the administrative interface and Field Effect says no exploitation has been reported.¹⁷