Barracuda Networks has issued an urgent advisory for two security vulnerabilities that, when chained together, allow unauthorized users to gain full root access to a range of its enterprise appliances. The disclosure, released on November 2, 2026, identifies a pre-authentication authorization bypass and an OS command injection flaw affecting several core products, including the Email Security Gateway (ESG) and Web Application Firewall (WAF).
The primary threat stems from the combination of CVE-2026-116606 and CVE-2026-111560. While the command injection vulnerability (CVE-2026-111560) carries a CVSS score of 8.6, its impact is significantly magnified when paired with the authorization bypass (CVE-2026-116606), which is rated at 9.3. According to the Barracuda Trust Center, successful chaining of these flaws allows an attacker to execute commands with the highest possible privileges on the device.
Technical Origin and Root Access Risk
The specific technical root cause of CVE-2026-111560 was identified as a vulnerability within the timezone configuration field of the appliance software. This specific field failed to properly sanitize inputs, allowing for the injection of operating system commands. Under normal circumstances, access to this configuration would require valid administrative credentials. However, the accompanying bypass vulnerability, CVE-2026-116606, removes this barrier for the Email Security Gateway, effectively opening the door for unauthenticated remote attackers.
Barracuda has clarified that these vulnerabilities are distinct from the widely reported ESG exploits of 2023. While the context of targeting security gateways is similar, these are new 2026 CVEs that require immediate attention from IT administrators. As of November 3, 2026, there have been no confirmed reports of these vulnerabilities being exploited in the wild.
Affected Products and Patch Information
The vulnerability impact extends across six different Barracuda product lines. Administrators are advised to verify that their appliances are running the latest security patches. For the Email Security Gateway, the target fix is contained in firmware version 9.4.0.030.
Barracuda has released the following specific patch identifiers for its hardware and virtual appliances:
- Email Security Gateway (ESG): Patch BNSF-40425 (Firmware 9.4.0.030)
- Load Balancer ADC & Web Application Firewall (WAF): Patch BNADC-16586
- Message Archiver (BMA): Patch BNMA-24954
- WAF Control Center (WCC): Patch BNCC-12165
- Web Security Gateway (WSG): Patch BNWF-34676
To successfully exploit these flaws, an attacker must be able to reach the administrative interface of the affected product. Security experts recommend that, in addition to applying the patches, organizations should ensure that management interfaces are not exposed to the public internet and are protected by strict access control lists or VPNs. Detailed remediation steps and official documentation can be found via the Barracuda Trust Center and technical advisories from Rescana.
