I’M UNDER A CYBER ATTACK

Alert

Logo de Barracuda

Alert 2026-148 Active exploitation of Barracuda Email Security Gateway

Affected product(s): 

ProductAffected versions
Barracuda Email Security Gateway (ESG)CVE-2026-116606 and CVE-2026-111560; 9.4.0.030 or later is recommended
Load Balancer ADCOnly CVE-2026-111560; all versions
Web Application Firewall (WAF)Only CVE-2026-111560; all versions
Web Security Gateway (WSG)Only CVE-2026-111560; all versions
Message Archiver (BMA)Only CVE-2026-111560; 5.2 through 5.5.4.001
WAF Control Center (WCC)Only CVE-2026-111560; all versions

The chain from unauthenticated access to root applies only to ESG and requires access to the administration interface.

Description

Two vulnerabilities have been disclosed in Barracuda Email Security Gateway that, when chained together and combined with access to the administration interface, allow authorization controls to be bypassed and root privileges to be obtained on the appliance. CVE-2026-116606 has a CVSS score of 9.3 (critical), and CVE-2026-111560 has a CVSS score of 8.6 (high).

CVE-2026-116606 is an unauthenticated authorization bypass (CWE-288): a remote attacker without credentials who gains access to the administration interface can invoke configuration import, restore a tampered backup file, and modify the global configuration. CVE-2026-111560 is an OS command injection (CWE-78) in the time zone field that, by itself, requires authenticated administrator access and, when the value is processed, executes commands as root.

On Nov 9, 2026 at 23:00 (PYT), the vendor stated that it had identified exploitation activity affecting a limited number of organizations, without attributing the activity to any actor, campaign, or ransomware. A public proof of concept for the chain has been available since Nov 3, 2026. As of Nov 10, 2026, these vulnerabilities do not appear in catalogs of known exploited vulnerabilities. The vendor has not published indicators of compromise.

Command injection also affects other Barracuda products (Load Balancer ADC, Web Application Firewall, Web Security Gateway, Message Archiver, and WAF Control Center), which have their own patches. In these products, the vulnerability still requires authenticated administrative access; it is not claimed that the chain from unauthenticated access to root applies outside ESG.

Mitigation

The vendor recommends restricting the administration interface to trusted internal networks. While fixes are being applied, it is recommended not to expose it to the Internet. Additionally:

  • Inventory all ESG, ADC, WAF, WSG, Message Archiver, and WAF Control Center appliances, including test and recovery environments.
  • Update ESG to 9.4.0.030 or later and verify that patches BNSF-40425 (in 9.4.017 or later) or BNSF-40430 (in versions earlier than 9.4.017) have been applied. The vendor’s documentation states that firmware 9.4.0.029 or later already includes the patches; if the appliance is running 9.4.0.029, confirm the patches and, if available, upgrade to 9.4.0.030 or later. Below 9.1, the update to 9.4 must be performed in two steps.
  • Apply the patches and firmware indicated by the vendor for the remaining products and re-enable automatic patching.
  • If the administration interface was exposed, treat the appliance as potentially compromised: review administrator accounts, configuration changes, mail routing rules, and subsequent activity. This review is a general recommendation; the vendor has not published official indicators.
  • Keep in mind that the patch closes the vulnerability but does not undo any access that has already been obtained.

Solution

The solution is to update the affected products to the versions and patches published by the vendor, starting with ESG:

  • Email Security Gateway: 9.4.0.030 or later, and verify BNSF-40425 or BNSF-40430 according to the release branch.
  • Load Balancer ADC: patch BNADC-16586. Automatically applied in versions 6.4 through 6.6.0.009; if an earlier version is installed, update and target 6.6.0.009 or later.
  • Web Application Firewall: patch BNADC-16586. Automatically applied in versions 11.0.1 through 12.3.0.011; if an earlier version is installed, update to 12.3.0.011 or later.
  • Web Security Gateway: patch BNYF-24789. Automatically applied in versions 15.0.0.009 through 16.1.003; request version 15.0.0.009 or later.
  • Message Archiver: patch BNMA-32468. Automatically applied in versions 5.5.0 through 5.5.4.001 (the firmware number does not change); in versions 5.2 through 5.4.x, upgrade to 5.5.4.002.
  • WAF Control Center: patch BNWF-60060. Automatically applied in versions 2.2.1 through 2.4.1.001; if an earlier version is installed, upgrade (the documentation lists 2.4.1.001 or later) and verify the patch.

Restrict access to the administration interface to trusted networks.

For information on how to update, visit the following link:

https://trust.barracuda.com/security/pre-authentication-authorization-bypass-command-injection

Additional information: