606/69 Thursday, November 5, 2026
Barracuda has released patches for two vulnerabilities affecting its Email Security Gateway (ESG) and related products. If chained together, the two flaws could allow an attacker to bypass authentication and ultimately gain root-level control of an affected appliance. Successful exploitation could give an attacker extensive access to the underlying security infrastructure and allow unauthorized changes to system configurations.
The vulnerabilities are CVE-2026-116606, rated Critical with a CVSS score of 9.3, and CVE-2026-111560, rated High with a CVSS score of 8.6. CVE-2026-116606 is an authentication bypass vulnerability that could allow an unauthenticated attacker to modify device configuration, while CVE-2026-111560 is an OS command injection flaw that could allow an administrator-level user to execute operating system commands with root privileges. Exploitation requires access to the appliance’s administrative interface. Email Security Gateway (ESG) is affected by both vulnerabilities and can be remediated with patch BNSF-40425 for version 9.4.017 and later, or BNSF-40430 for earlier versions. Products affected only by the command injection vulnerability include Load Balancer ADC and Web Application Firewall (WAF), which use patch BNADC-16586; Message Archiver (BMA), which uses BNMA-32468; WAF Control Center (WCC), which uses BNWF-60060; and Web Security Gateway (WSG), which uses BNYF-24789.
To reduce exposure, administrators should restrict access to management interfaces so they are reachable only from trusted internal networks and apply appropriate network access controls to minimize the attack surface. Devices should also be running the latest firmware and all available patches. If automatic updates are disabled, administrators should manually install the required patches as soon as possible by following guidance provided through Barracuda Campus and consider enabling automatic patch delivery. Systems that are several releases behind should be upgraded incrementally in the recommended sequence to ensure that all required fixes are applied correctly.