Barracuda chains CVE-2026-116606 and CVE-2026-111560 to root

Barracuda disclosed two vulnerabilities that chain to a root shell on its appliances. CVE-2026-116606 (CVSS 9.3), a pre-authentication authorization bypass in the Email Security Gateway, and CVE-2026-111560 (CVSS 8.6), a command-injection flaw spanning six product lines. The vendor's advisory, published November 2, says that "exploited in combination" the pair lets an attacker bypass authorization controls and obtain root. Exploitation requires network access to the administrative interface.

Affected products

• CVE-2026-116606 (9.3) — Email Security Gateway (ESG) only.
• CVE-2026-111560 (8.6) — ESG, Load Balancer ADC, Message Archiver, WAF Control Center, Web Application Firewall, and Web Security Gateway.

The authorization bypass is scoped to the ESG; the command-injection bug reaches the rest of the line. A fully-patched ESG closes both.

Patch state

Barracuda ships the fixes as named firmware patches rather than a single version bump:

• ESG: BNSF-40425 (for 9.4.017 and later) or BNSF-40430 (for releases before 9.4.017).
• Load Balancer ADC / Web Application Firewall: BNADC-16586.
• Message Archiver: BNMA-32468.
• WAF Control Center: BNWF-60060.
• Web Security Gateway: BNYF-24789.

Barracuda notes that firmware several versions behind may need more than one update to reach the fixed build. Confirm the applied patch ID, not just the firmware string.

Exploitation status

Barracuda's advisory makes no claim of in-the-wild exploitation and names no public proof-of-concept. Both flaws require reaching the administrative interface; the vendor states that appliances not exposing admin interfaces to the internet are "less vulnerable to this attack path." That is the whole mitigation story — this is not a case where an unauthenticated internet attacker walks straight to root. It is a case where an exposed or laterally-reachable admin interface becomes a root pivot.

Action checklist

1. Apply the patch ID for each affected product today — prioritize any ESG, which carries both CVEs.
2. Remove administrative interfaces from the public internet and from flat user VLANs; restrict them to a management network.
3. After patching, verify the running patch ID (not just the firmware version) on every appliance in the fleet.
4. Review admin-interface access logs on any appliance that was internet-reachable before patching.

Context

The ESG is familiar ground for this. In 2023 a zero-day in the same product line, CVE-2023-2868, was mass-exploited for months before disclosure; Mandiant attributed that campaign to the China-nexus cluster it tracks as UNC4841, and Barracuda ultimately told some customers to replace hardware rather than patch. The flaws here are not that — they need admin-interface reach and there is no exploitation report — but an email gateway sitting at the network edge is a high-value box, and a 9.3 auth bypass on it does not stay theoretical for long once patch diffs are public.