Barracuda Patches Critical Authorization Bypass and Command Injection Flaws

TL;DR

Barracuda Networks released security fixes on November 2, 2026. The update addresses two high-risk Barracuda vulnerabilities across several enterprise appliances. When attackers chain these flaws together, they can gain full control of the device. Therefore, system administrators must install the patches right away.

Why It Matters

Barracuda protects over 200,000 corporate clients globally, based on company reports. In addition, Shodan telemetry shows that thousands of appliance management portals remain visible on the public web.

In its security advisory, the vendor warned of the threat: “If exploited in combination, these vulnerabilities could allow an attacker to bypass authorization controls and obtain root access to the device.” Consequently, attackers who breach these gateways can access sensitive email and web traffic. However, Barracuda confirmed that no active exploitation in the wild has occurred. Furthermore, researchers have released no public proof-of-concept exploit code.

How the Attack Works

Mandiant researchers discovered both flaws in the core firmware. Specifically, the bugs target the web management screen of affected appliances.

Pre-Authentication Authorization Bypass

First, CVE-2026-116606 is an authorization bypass flaw in the Email Security Gateway. An unauthenticated attacker can call an import function to restore a custom backup file. This step alters core device settings without any login credentials.

Root Command Injection

Next, CVE-2026-111560 is a command injection bug in shared appliance code. The flaw stems from poor input checks on the timezone field. When the system processes a bad timezone string, it executes shell commands as root. Thus, an attacker who links both flaws gains complete root control.

Affected Versions

These Barracuda vulnerabilities affect several products. CVE-2026-116606 impacts Email Security Gateway versions before 9.4.0.030. Meanwhile, CVE-2026-111560 impacts Email Security Gateway, Web Application Firewall, and Load Balancer ADC. It also affects Message Archiver, Web Security Gateway, and WCC.

Patch and Mitigation Steps

Barracuda released patches for all affected models. The vendor noted: “Successful exploitation requires an attacker to have access to the administrative interface of an affected product.”

Administrators should check the official Barracuda security advisory and apply patches immediately. Furthermore, teams must restrict web admin access to private networks.

×

Support Our Threat Intelligence

Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!

Buy Me a Coffee

PayPal

Select your plan

Free Pro Team

Hover over a plan to see its benefits.

Written by

@DdoS · Security Researcher

Do Son

Do Son is the Founder and Editor of SecurityOnline.info. Working in cybersecurity since 2013, he reports on vulnerabilities, malware, and emerging threats, providing timely analysis to help organizations and individuals stay ahead of evolving risks.