Barracuda Networks has told customers to install patches for two vulnerabilities that can be chained to run commands as root on its appliances. The first, CVE-2026-116606, is an authorization bypass in the Email Security Gateway (ESG) that lets an attacker change the appliance’s global configuration. The second, CVE-2026-111560, is an operating-system command injection that runs as root and needs administrator permissions. Barracuda’s advisory says that used together, they “could allow an attacker to bypass authorization controls and obtain root access to the device.”
Both flaws require access to the device’s administrative interface, and Barracuda says organizations whose admin interfaces are not reachable from the internet are less exposed. BleepingComputer calls the first flaw critical, while Barracuda’s advisory rates it High with a CVSS score of 9.3 (the command injection is rated High at 8.6). Neither Barracuda nor BleepingComputer reports that either flaw has been exploited. BleepingComputer recalls that Barracuda ESG appliances were the target of the UNC4841 espionage campaign in 2023, which abused a different flaw, CVE-2023-2868.
How to check if you’re affected
Affected products, per Barracuda’s advisory, are the Email Security Gateway (both CVEs), and the Load Balancer ADC, Message Archiver, WAF Control Center, Web Application Firewall and Web Security Gateway (CVE-2026-111560 only). The patch for each:
| Product | Patch |
|---|---|
| Email Security Gateway | BNSF-40425 (firmware 9.4.017 and later) or BNSF-40430 (versions before 9.4.017) |
| Load Balancer ADC | BNADC-16586 |
| Message Archiver | BNMA-32468 |
| WAF Control Center | BNWF-60060 |
| Web Application Firewall | BNADC-16586 |
| Web Security Gateway | BNYF-24789 |
Barracuda says to confirm the device runs the latest firmware and has all security patches; if firmware is several versions behind, more than one update may be needed. If a patch was not applied automatically, apply it manually, and if automatic patching is turned off, Barracuda recommends turning it back on. It also recommends restricting administrative interfaces to trusted internal networks. Instructions for manual patching are on Barracuda Campus, and Barracuda Support can help with firmware checks.