Barracuda Patches Two Vulnerabilities That Can Chain to Root

Owners of Barracuda email, web and application security appliances should check their firmware this week. Barracuda has released patches for two vulnerabilities across six products which, used together, “could allow an attacker to bypass authorization controls and obtain root access to the device”. There is an important limit: the company says an attacker first needs access to the product’s administrative interface.

These Barracuda vulnerabilities matter because of where these boxes sit. Email gateways and web application firewalls stand at the edge of a network, filtering traffic before it reaches anything else, so a device taken over at root level would be a foothold in a trusted position. The fix is available now, and so is a simple second layer of defence: keep the admin page off the open internet.

Six products share one command injection flaw

According to Barracuda’s advisory, published on 2 November, the first of the Barracuda vulnerabilities, CVE-2026-116606, is a “pre-authentication authorization bypass” that affects only the Email Security Gateway (ESG). CVE-2026-111560 is a command injection flaw, a bug that lets crafted input be run as operating-system commands. It affects the ESG plus the Load Balancer Application Delivery Controller (ADC), Message Archiver (BMA), Web Application Firewall (WAF), WAF Control Center (WCC) and Web Security Gateway (WSG).

Barracuda rates both “High”. It gives a CVSS score of 9.3 for the bypass and 8.6 for the command injection flaw, and lists “administrative access” as required for both. BleepingComputer, which described the first flaw as critical, reported that it can be used to modify an appliance’s global configuration.

Canada’s national cyber agency issued its own notice the same day. The Canadian Centre for Cyber Security’s advisory AV26-1112 lists the versions it considers affected and “encourages users and administrators to review the provided web links and apply any necessary updates”.

ESG owners need firmware 9.4.0.029 or later

Barracuda’s instructions for the Email Security Gateway say all versions are affected and that firmware 9.4.0.029 includes the patches. Administrators can check the installed version under Advanced > Firmware Update and confirm it reads 9.4.0.029 or later after updating. Appliances below firmware 9.1 must be updated in two steps. The Cyber Centre, by contrast, lists ESG versions before 9.4.0.030 as affected, so the safest course is the latest firmware the appliance offers.

For the other products, Barracuda lists patch identifiers rather than version numbers. Its Campus summary links product-by-product instructions. If a patch has not been applied automatically, the company says customers should apply it manually “as soon as possible”, and it recommends turning automatic patching back on where it has been switched off. Devices several versions behind may need more than one update.

The advisory does not say either of the Barracuda vulnerabilities has been exploited. It does say that organisations “whose administrative interfaces are not publicly accessible from the internet are less exposed”, and recommends limiting those interfaces to trusted internal networks.

Why the admin interface is the real line of defence

The condition attached to the Barracuda vulnerabilities is also the most useful guidance in the advisory. An attack that needs the management page cannot start from a mailbox or a web form; it needs someone who can reach that page. For an organisation that already keeps admin access on an internal network or behind a VPN, the risk is much narrower than the scores alone suggest. For one that exposes the console to the internet for convenience, the same advisory reads very differently.

That makes this a two-step job rather than a one-step one. Patching closes the flaws; restricting the admin interface shrinks the attack surface for the next flaw too. Security teams have heard similar advice this autumn, when Node-RED users were urged to lock down an exposed admin API and Synology told NAS owners to update DSM.

The mismatch between Barracuda’s ESG version and the Cyber Centre’s list is a small thing, but it shows why an admin should check the number on the device rather than rely on a summary. The same goes for severity. “High” with a score of 9.3, a “critical” headline elsewhere, and a requirement for admin access all describe the same bug, and only the organisation’s own network layout decides how urgent it is.

Barracuda’s email gateway has been here before

ESG owners have reason to move quickly. In 2023 a flaw in the gateway, CVE-2023-2868, was exploited from as early as October 2022, according to Mandiant, which assessed with high confidence that UNC4841, an espionage group it tracks, was acting in support of China. In a later post, Mandiant said about 5% of ESG appliances worldwide were compromised and affected customers were told to replace them.

That flaw was different: Mandiant said it was exploited through malicious emails, with no admin access needed. Even so, the episode showed how attractive email gateways are as targets, a pattern TSN saw again in October when Cisco patched a Secure Email Gateway zero-day that was already in use. This is also Barracuda’s second ESG fix in seven weeks: in September it released firmware 9.4.0.027 for a remote code execution flaw in a third-party component.

Teams that track flaws across many vendors can also use free feeds such as Cloudflare’s new Zero Wire service. The next marker to watch is whether Barracuda or the Cyber Centre revises its ESG version number, and whether either of the Barracuda vulnerabilities is added to a known-exploited list.

Sources

Primary:

• Barracuda Networks: Pre-Authentication Authorization Bypass and Command Injection Vulnerabilities in Certain Barracuda Products, 2 November 2026
• Canadian Centre for Cyber Security: Barracuda Networks security advisory (AV26-1112), 2 November 2026
• Barracuda Campus: Security Updates Available for Certain Barracuda Products
• Barracuda Campus: Pre-Authentication Authorization Bypass and Command Injection Vulnerabilities (Email Security Gateway)
• Barracuda Networks: RCE Vulnerability in Barracuda ESG Appliances – Hotfix Available, 21 September 2026
• Mandiant: Barracuda ESG Zero-Day Vulnerability (CVE-2023-2868) Exploited Globally, 15 June 2023
• Mandiant: Diving Deep into UNC4841 Operations Following Barracuda ESG Zero-Day Remediation

Press:

• BleepingComputer: Barracuda warns of critical flaws allowing root access to devices

Related stories

• Cisco Patches a Secure Email Gateway Zero-Day That Attackers Are Already Using
• Patch and Lock Down Node-RED as Attackers Exploit Admin API Flaw
• Synology Urges NAS Owners to Update DSM After Ransomware Attacks