Barracuda Networks has patched two vulnerabilities in its Email Security Gateway that could, if exploited together, allow an attacker to bypass authorisation controls and obtain root access to an appliance. The patches were released on 2 November 2026, and no exploitation of the flaws has been reported.

The first flaw, CVE-2026-116606, is a pre-authentication authorisation bypass affecting only the Email Security Gateway, with a CVSS v4.0 score of 9.3. According to Mandiant’s technical disclosure, an unauthenticated remote attacker could invoke a configuration-import function and restore a crafted backup archive, changing the appliance’s global configuration. The second flaw, CVE-2026-111560, is a command injection vulnerability in a timezone configuration field, with a CVSS v4.0 score of 8.6: an authenticated administrator could inject operating-system commands that run with root privileges.

Admin access required, and the patch list

Chained together, the two flaws could give an attacker root-level control of an Email Security Gateway. But Barracuda says successful exploitation requires access to the administrative interfaces of the targeted devices, and advises customers to restrict those interfaces to trusted internal networks. Organisations whose admin interfaces are not publicly accessible from the internet are less exposed.

For the Email Security Gateway, the fixes are BNSF-40425 for firmware 9.4.017 and later and BNSF-40430 for earlier versions; firmware 9.4.0.029 or later is patched. The command injection flaw also affects five further product families — the Load Balancer ADC, Message Archiver, Web Application Firewall, WAF Control Center and Web Security Gateway — with separate patch identifiers for each. Canada’s Cyber Centre has urged administrators to review the advisory and apply the updates.

Sources: BleepingComputer, Barracuda warns of critical flaws allowing root access to devices, 3 November 2026; eSecurity Planet, Barracuda Patches Two Flaws That Could Give Hackers Root Access, 5 November 2026.