Barracuda Patches a Chain That Can Give Attackers Root
Barracuda has released patches for two flaws that can be combined to take control of its Email Security Gateway. The chain starts at the administrative interface. An attacker who can reach it may be able to alter the appliance’s configuration and then run commands with root privileges. Check which networks can reach the admin interface before treating an internal appliance as low risk. Barracuda advisory
Where the chain applies
The first flaw exposes the gateway’s configuration import to an attacker who can reach the administrative interface. The second allows someone with administrative access to run system commands through the time zone setting. The Email Security Gateway is affected by both. The command injection also affects the Load Balancer ADC, Message Archiver, WAF Control Center, Web Application Firewall and Web Security Gateway. Those five products have their own patch routes. CVE-2026-116606 · CVE-2026-111560 · Mandiant’s command-injection disclosure
What to verify
Restrict the management interface to trusted administration networks. Check the firmware and the actual patch status on each device, including standby units. Barracuda lists separate Email Security Gateway patch packages for the two firmware groups. Follow the vendor’s mapping for the appliance in front of you and check the update status again after maintenance. Barracuda patch and access guidance
Update, 5 November 2026
Barracuda corrected the authentication field in its advisory. The configuration-import flaw can be exploited without signing in when the attacker can reach the administrative interface. The separate command-injection flaw requires administrative access when used on its own. Barracuda advisory revision
Update, 10 November 2026
Barracuda disclosed exploitation affecting a small number of organisations in an update dated 9 November in the US. CISA listed both vulnerabilities on 10 November and set a 13 November deadline for covered US federal agencies, with forensic triage required. If the administrative interface was reachable from untrusted networks, preserve configuration backups and logs and check for unexpected imports, configuration changes and administrator activity. Barracuda exploitation update · CISA catalogue
