On this page
Barracuda and Mandiant published two bugs on November 2 that, used together, take a Barracuda Email Security Gateway from "never logged in" to a root shell. The entry point is the appliance's admin web interface, not the mail port. If that interface answers from the internet, this is the appliance to patch first this week.
CVE-2026-116606 (CVSS 4.0 9.3) is an authentication bypass in the ESG that lets an outsider call the configuration-import function and restore a crafted backup, which rewrites the appliance's global configuration. CVE-2026-111560 (CVSS 4.0 8.6) is a command injection in the timezone field that runs as root, shared by six Barracuda products. Barracuda's own wording: "If exploited in combination, these vulnerabilities could allow an attacker to bypass authorization controls and obtain root access to the device."
How to fix
Update the firmware from the appliance itself. In the ESG web interface go to ADVANCED > Firmware Update, read Current Installed Version, and click Update until it stops offering a newer build. Then reboot if prompted and read the version again.
- Target build: the published numbers do not agree. Barracuda's Campus article says 9.4.0.029 or later. The CVE record and Mandiant's MNDT-2026-0042 say the bypass affects versions earlier than 9.4.0.030. Take 9.4.0.030 or later if your appliance offers it. If it tops out at 9.4.0.029, confirm with Barracuda Support that CVE-2026-116606 is covered on that build before you close the ticket.
- Patch IDs to look for: BNSF-40425 on 9.4.017 and later, BNSF-40430 on older builds, per the Trust Center table.
- Old firmware: below 9.1 you cannot jump straight to the fixed build. Barracuda says to update in two steps.
- Turn patching on: in the Firmware Patches section of the same page, check Apply Patches. Barracuda's documentation lists Disable as the default mode, which means patches show up but are not applied. Set it to Automatic if your change process allows it. Automatic mode does not reboot for you, so watch for the prompt.
Other Barracuda appliances only get the timezone injection, and the fix is the same move: ADVANCED > Firmware Update, latest build. Patch IDs from the advisory: Load Balancer ADC and WAF BNADC-16586, Message Archiver BNMA-32468, WAF Control Center BNWF-60060, Web Security Gateway BNYF-24789.
Is your admin page reachable?
Barracuda says exploitation needs access to the administrative interface, and that appliances whose admin interface is not reachable from the internet are less exposed. The ESG web interface listens on HTTP port 8000 by default. From a machine outside your network, run this with your gateway's public address in place of 203.0.113.10:
curl --include --max-time 10 http://203.0.113.10:8000/Look at the first line of the output. A status line such as HTTP/1.1 200 or 302 means the login page is on the internet. A timeout or a refused connection means nothing answered, which is what you want. If it answers, restrict the port to a management network or VPN at your firewall today, then patch. Run the same check against any HTTPS port you published for admin access.
How the chain works
The two bugs were reported to Mandiant a week apart: the timezone injection on October 15, the bypass on October 22. Neither is interesting alone in the way that matters for defenders.
The timezone bug needs an administrator session. On its own it is a post-login root escalation, the kind of thing that matters when an admin password leaks. The bypass removes that requirement on the ESG. An unauthenticated request reaches the config-import function, and a crafted but compatible backup archive gets restored as the appliance's global configuration. That alone hands a stranger control of how the appliance is set up. With the config under the attacker's control, the timezone field is one more setting, and when the appliance processes it the injected command runs as root.
One thing to know when you read Barracuda's advisory: its summary block lists "Authentication Required: Yes, administrative access" for both CVEs, while the title says pre-authentication and the CVE record scores CVE-2026-116606 with no privileges required. Read "administrative access" as network access to the admin interface, not a password. That is why the port check above matters more than how strong your admin password is.
Who is not in scope
- Load Balancer ADC, Web Application Firewall, Message Archiver, WAF Control Center and Web Security Gateway are only listed for CVE-2026-111560. On those boxes an attacker needs real admin credentials first. Patch them, but they are not the no-login case.
- Barracuda's cloud email products are not in the affected product list. The advisory covers the Email Security Gateway appliance and the five appliances above.
- An ESG whose admin interface is only reachable from a management network is still vulnerable, but the attacker has to be on that network already.
What this is not
This is not an email-borne bug. In 2023, CVE-2023-2868 fired when the ESG processed a crafted .tar attachment, so any sender could reach it, and CISA added it to the Known Exploited Vulnerabilities catalog on May 26, 2023. This chain needs the admin web interface. As of the CISA catalog dated October 30, 2026, neither new CVE is on the KEV list, and neither Barracuda nor Mandiant reports exploitation in the wild.
HOL Guard keeps the source record for this issue on the CVE-2026-116606 evidence pack. This post is the operator write-up.
What do people ask about the Barracuda ESG bugs?
Which firmware fixes CVE-2026-116606?
Barracuda's Campus article says 9.4.0.029 or later. The CVE record and Mandiant say versions before 9.4.0.030 are affected. Install the newest build ADVANCED > Firmware Update offers and confirm coverage with Barracuda Support if you stop at 9.4.0.029.
Does an attacker need a password?
Not on the Email Security Gateway. CVE-2026-116606 is scored with no privileges required and skips the login. The attacker does need to reach the admin web interface, which is port 8000 by default.
Can a malicious email trigger this?
No. Barracuda says exploitation requires access to the administrative interface. Mail arriving on port 25 is not the entry point, unlike the 2023 .tar attachment bug.
Is it being exploited?
Not according to Barracuda, Mandiant or CISA as of November 2, 2026. Neither CVE is on the KEV catalog.
Will the appliance patch itself?
Only if Apply Patches under Firmware Patches is set to Automatic. Barracuda's documentation lists Disable as the default, so check the setting on every appliance.
References
- Barracuda Trust Center: Pre-Authentication Authorization Bypass and Command Injection Vulnerabilities in Certain Barracuda Products
- Barracuda Campus: ESG remediation steps for CVE-2026-116606 and CVE-2026-111560
- Barracuda Campus: Security Updates Available for Certain Barracuda Products
- Mandiant MNDT-2026-0042 (CVE-2026-116606)
- Mandiant MNDT-2026-0041 (CVE-2026-111560)
- Barracuda Campus: How to Apply the Latest Firmware Patches (ESG)
- Barracuda Campus: ESG Initial Configuration (web interface on port 8000)
- CVE-2026-116606
- CVE-2026-111560
- NVD: CVE-2023-2868 (2023 ESG .tar attachment bug)
