Events Secure.com at Black Hat USA 2026
Published: November 5, 2026 5 min read

Barracuda’s Admin Page Problem: Two Flaws, Full Root, Zero Logins

Two Barracuda appliance vulnerabilities chain into root access. See affected products, patch IDs and what to lock before attackers move in.

By Secure.com
Summary

Two Bugs, One Root Shell: Barracuda Patches Six Appliance Lines After Chainable Flaws Surface

Barracuda pushed emergency fixes on November 2 for two flaws that, chained together, let an attacker go from zero credentials to root on a security appliance. No login, no phishing, just network access to the admin page.

What Happened?

The Authorization Bypass: CVE-2026-116606

The first bug, CVE-2026-116606 (CVSS 9.3), is an authorization bypass in Barracuda Email Security Gateway (ESG). An unauthenticated attacker can call the configuration import function and restore a crafted backup, rewriting the device’s global settings without signing in. Every ESG build before 9.4.0.030 is affected.

The Timezone Command Injection: CVE-2026-111560

The second, CVE-2026-111560 (CVSS 8.6), sits in shared Barracuda code behind the timezone setting. Shell characters in that field aren’t cleaned up, so they run as root. On its own, it requires an admin login. Paired with the first flaw, that hurdle disappears.

Threat Brief · Barracuda Appliances

Two bugs. One root shell.

Neither flaw is a full takeover on its own. Chained, they take an attacker from no credentials to root on the appliance, with nothing more than network access to the admin page.

Step 1 · No loginAuthorization bypassCVE-2026-116606 · CVSS 9.3Attacker calls the config import function and restores a crafted backup on Email Security Gateway.
→
Step 2 · Admin sideTimezone command injectionCVE-2026-111560 · CVSS 8.6Shell characters in the timezone field are never cleaned, so the system runs them.
→
ResultRoot on the deviceRead and reroute mail, plant persistence, pivot deeper into the network.

The common thread: an admin interface reachable by the attacker. Take that away and the chain breaks at step one.

Affected Products and Versions

The shared code means the command injection reaches well beyond email. Affected versions include:

  • ESG up to 9.4.0.27
  • Load Balancer ADC up to 6.4.0
  • Web Application Firewall up to 11.0.1
  • Web Security Gateway up to 16.1.100.100
  • Message Archiver up to 5.5.4.0
  • WAF Control Center up to 2.2.1
Exposure Map · Nov 2026

One shared bug. Six product lines.

The timezone injection lives in code Barracuda reuses across its appliances. Only the email gateway carries both flaws, but every box below needs a patch.

ESG
Email Security Gateway
≤ 9.4.0.27
Both CVEs
ADC
Load Balancer ADC
≤ 6.4.0
CVE-2026-111560
WAF
Web Application Firewall
≤ 11.0.1
CVE-2026-111560
WSG
Web Security Gateway
≤ 16.1.100.100
CVE-2026-111560
BMA
Message Archiver
≤ 5.5.4.0
CVE-2026-111560
WCC
WAF Control Center
≤ 2.2.1
CVE-2026-111560
Full chain possible (no login needed)Root via admin login

Versions shown are the last affected builds listed in the CVE record. Check the vendor advisory for the exact patch ID for your model.

External security researchers found both issues. Barracuda says it has seen no exploitation in the wild, and no public proof of concept has appeared yet.

What’s the Impact?

Root on an email gateway is about as bad as it gets. Whoever owns the box can read and reroute mail, plant persistence, and pivot inward. Your firewall or load balancer becomes the attacker’s foothold, not your defense.

Thousands of Barracuda management portals are visible on the open internet, according to Shodan data cited in early coverage. Each one is a candidate.

Why the Clock Matters

Barracuda ESG owners have been here before. In 2023, a command injection bug in the same product line (CVE-2023-2868) was quietly exploited for roughly seven months before anyone noticed. The fix came too late for many, and Barracuda ended up telling affected customers to physically replace their appliances because patching could not guarantee a clean device.

This time the patch landed first. That head start only helps if you use it. Our exposure prioritization playbook walks through how to decide what gets fixed first.

How to Avoid This

  • Patch now. ESG needs BNSF-40425 on 9.4.017 or later, or BNSF-40430 below 9.4.017. Other products have their own patch IDs in the vendor advisory.
  • Pull admin interfaces off the internet. Allow only trusted internal networks or a VPN.
  • Confirm automatic patching is actually switched on, not assumed.
  • Audit the timezone setting and recent configuration restores for anything odd.
  • Rotate admin credentials on any appliance with a publicly exposed console.
Response Plan · Next 48 Hours

No exploits yet. Use the head start.

In 2023, a Barracuda gateway bug was exploited for months before a fix shipped. This time the patch came first. Here’s how to keep it that way.

01
Patch the gateway
ESG on 9.4.017 or later: BNSF-40425. Below 9.4.017: BNSF-40430.
02
Patch everything else
ADC, WAF, WSG, Message Archiver and WCC each have their own fix in the advisory.
03
Close the admin door
Allow the management interface only from trusted internal networks or a VPN.
04
Verify auto patching
Confirm it’s switched on per appliance. Don’t assume.
05
Hunt for tampering
Review the timezone value and any recent config restores. Rotate admin creds on exposed boxes.

Teal = patch, blue = harden, amber = verify.

Know Which Doors Are Open Before Attackers Do

Most teams can’t say, right now, how many appliance admin panels they have facing the internet. That gap is where chained bugs like these do the most damage, and it’s the core difference between exposure management and vulnerability management.

Secure.com helps you close it:

  • Discovers internet-facing appliances and admin consoles across your estate, including the ones nobody logged
  • Ranks CVE-2026-116606 and CVE-2026-111560 by real exposure and asset value, so exposed gateways jump the queue
  • Tracks each fix against an SLA and nudges owners when tickets stall
  • Rescans after patching to confirm the hole is actually closed
  • Flags new exploitation signals (KEV listings, public exploits) the moment they appear

Frequently Asked Questions

What are the new Barracuda appliance vulnerabilities?
Two flaws were patched on November 2, 2026. CVE-2026-116606 (CVSS 9.3) is an authorization bypass in Email Security Gateway that lets an unauthenticated attacker restore a crafted configuration backup. CVE-2026-111560 (CVSS 8.6) is a command injection in the timezone setting that runs attacker commands as root. Together, they allow an attacker to gain root access without logging in.
Which Barracuda products are affected?
Email Security Gateway carries both flaws. The timezone command injection also affects Load Balancer ADC, Web Application Firewall, Web Security Gateway, Message Archiver and WAF Control Center, because they share the same underlying code.
Are the Barracuda flaws being exploited in the wild?
Not yet. Barracuda says it has seen no exploitation, the flaws are not on the CISA KEV list, and no public proof of concept has been released. That can change quickly, so patch now rather than waiting for the first attack.
How do I patch Barracuda Email Security Gateway?
Apply BNSF-40425 if your ESG runs 9.4.017 or later, or BNSF-40430 if it runs an older build. Then confirm automatic patching is enabled on each appliance, and check the vendor advisory for fixes for your other Barracuda products.
Can CVE-2026-111560 be exploited without a login?
On its own, no. The timezone injection needs an administrator login. On Email Security Gateway, however, CVE-2026-116606 removes that requirement, which is why the two flaws together are so dangerous.
How can I reduce my risk before patching?
Restrict the management interface to trusted internal networks or a VPN, review the timezone value and recent configuration restores for anything unexpected, and rotate admin credentials on any appliance whose console was exposed to the internet.

Other News