Barracuda ESG CVE-2026-116606: 9.3 auth bypass that ends in root
Unauthenticated configuration restore on Email Security Gateway, chained with a command injection

Barracuda ESG CVE-2026-116606: 9.3 auth bypass that ends in root

Barracuda has patched two flaws that chain into root access across six of its appliance families, and the email gateway is exposed to both. The company says exploitation requires reaching the administrative interface, which makes exposure a network design question as much as a patching one.

What happened

CVE-2026-116606 is an authentication bypass in Email Security Gateway builds earlier than 9.4.0.030. An unauthenticated remote attacker can invoke the configuration-import function and restore a crafted backup archive, which rewrites the appliance's global configuration. Barracuda rates it 9.3 critical.

CVE-2026-111560 is a shell metacharacter injection in the timezone field. An authenticated administrator can plant a value that executes OS commands as root when it is processed later. Rated 8.6. Chained, the two give an unauthenticated attacker root on the box.

Who is affected

Organisations running Barracuda appliances on older firmware, particularly anyone who exposed the management interface beyond a trusted management network.

  • Email Security Gateway: both CVEs, fixed in BNSF-40425 (9.4.017 and later) or BNSF-40430 on older branches
  • Load Balancer ADC and Web Application Firewall: CVE-2026-111560, fixed in BNADC-16586
  • Message Archiver: CVE-2026-111560, fixed in BNMA-32468
  • Web Security Gateway: CVE-2026-111560, fixed in BNYF-24789
  • WAF Control Center: CVE-2026-111560, fixed in BNWF-60060

What to do now

Apply the firmware for your model and branch, then verify the admin interface is not reachable from the internet or from general user VLANs.

  • Check the current firmware version against Barracuda's advisory table before assuming auto-update handled it.
  • Restrict the admin UI to a management VLAN or named source addresses at the firewall.
  • Change local admin credentials and rotate any secrets the appliance stores, such as directory bind accounts and SMTP relay credentials.
  • Review configuration for import or timezone changes you did not make, and check for unexpected local accounts.
  • Barracuda appliances have been hit before by a state-linked group, so treat post-patch review as part of the job, not optional.

What this means for South African businesses

Email gateways sit at the edge of the network and are often managed over the same flat LAN as staff laptops, which is precisely the access the advisory assumes an attacker does not have. My judgement: the patch is straightforward, but the exposure is not, because nobody goes back to re-check which VLAN the appliance answers on after the initial install. An SME running an older ESG with a web-managed interface reachable from the office network has real work to do this week.

Source: BleepingComputer and the Barracuda security advisory.

Also on the blog

Next step: If this is on your network or a client's, ask Matthews Enterprises to check exposure.

Synology C3RB3R ransomware: 380,000 exposed NAS devices, old DSM to blame
C3RB3R is encrypting Synology NAS boxes that never took the December 2024 DSM patch