Barracuda Networks has released patches for two vulnerabilities affecting its Email Security Gateway and five other security products. The flaws, CVE-2026-116606 and CVE-2026-111560, could be chained to bypass security controls and obtain root access on an affected appliance, the company said in a November 2 security advisory.
CVE-2026-116606 is a pre-authentication authorization bypass in the Email Security Gateway. Mandiant’s disclosure says an unauthenticated remote attacker can invoke the configuration-import function and restore a crafted backup archive, changing the appliance’s global configuration. The flaw has a CVSS 4.0 score of 9.3. Barracuda’s advisory, however, lists administrative access as required for this CVE, so the sources differ on whether credentials are needed.
The second flaw, CVE-2026-111560, is a command-injection vulnerability in a timezone configuration field. Mandiant’s report says an authenticated administrator can inject operating-system commands that run with root privileges when the value is processed. It affects the Email Security Gateway, Load Balancer Application Delivery Controller, Web Application Firewall, Web Security Gateway, Message Archiver and WAF Control Center, and carries a CVSS 4.0 score of 8.6.
Barracuda says successful exploitation requires access to an affected product’s administrative interface. The company lists patches BNSF-40425 and BNSF-40430 for the Email Security Gateway, BNADC-16586 for the Load Balancer ADC and Web Application Firewall, BNMA-32468 for Message Archiver, BNWF-60060 for WAF Control Center, and BNYF-24789 for Web Security Gateway. The Canadian Centre for Cyber Security lists affected builds before ESG 9.4.0.030, ADC 6.4.0, WAF 11.0.1, WSG 16.1.100.100, BMA 5.5.4.0 and WCC 2.2.1; Mandiant includes several endpoint versions in its affected ranges.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
Barracuda Patches Two Flaws That Could Lead to Root Access
