Barracuda ESG: unauthenticated path to root on mail gateways
Two chainable flaws give root on Barracuda mail gateways, including a 9.3-rated authentication bypass. Fixes available since November 2.
Who is affected
- Barracuda Email Security Gateway (ESG) prior to 9.4.0.030
- Barracuda Load Balancer ADC prior to 6.4.0, Web Application Firewall prior to 11.0.1
- Barracuda Web Security Gateway prior to 16.1.100.100, Message Archiver prior to 5.5.4.0, WAF Control Center prior to 2.2.1
How to fix
Update every appliance line: ESG 9.4.0.030 or later, ADC 6.4.0, WAF 11.0.1, WSG 16.1.100.100, Message Archiver 5.5.4.0, WAF Control Center 2.2.1. Restrict CLI and web management access to a dedicated VLAN filtered by firewall policy, never exposed to the internet. Enable automatic firmware patch delivery. On unpatched versions, review configuration-import and timezone-field change logs: those are the two waypoints of the exploit chain.
What happened
Barracuda and the Canadian Centre for Cyber Security published two flaws in Barracuda appliances on November 2. CVE-2026-116606 (CVSS v4.0: 9.3) lets a remote, unauthenticated attacker invoke the Email Security Gateway's configuration-import function and restore a purpose-built backup archive, changing the appliance's global configuration. CVE-2026-111560 (8.6) is an OS command injection in the timezone configuration field: a command entered by an authenticated administrator runs as root. Barracuda states that chained together the two bypass authorization controls and yield root, provided the attacker can reach the administrative interface. No exploitation has been reported, and neither CVE appears in the CISA KEV catalog as of November 2.
Why it matters for a hotel
The email security gateway is the phishing filter for the front desk, reservations and accounting: it is the layer that stops fake guest reviews, spoofed quote requests and fraudulent wire instructions. An attacker who owns this layer reads your mail before your staff do, disables filtering at the source, and gains a foothold on the internal network, typically two hops from the property management system. ESG appliances are also commonly administered remotely, sometimes exposed outright.
Who is affected
Six product lines, per the AV26-1112 matrix: Email Security Gateway before 9.4.0.030, Load Balancer ADC before 6.4.0, Web Application Firewall before 11.0.1, Web Security Gateway before 16.1.100.100, Message Archiver before 5.5.4.0, WAF Control Center before 2.2.1. The authentication bypass affects the ESG only; the command injection affects all six lines, which share the same code.
How to fix
- Update each appliance line to the fixed versions listed above and verify the installed version, not just the last reboot date.
- Move CLI and web management interfaces to a dedicated VLAN reachable only from a firewall-filtered administration range; cut any direct internet exposure.
- Enable automatic firmware patch delivery in the appliance's management console.
- On unpatched versions, audit configuration-import and timezone-change logs, and treat any period where the management interface was reachable from outside as a potential incident.
Context
The chain requires reaching the administrative interface, so network isolation of that interface is the countermeasure that holds even before patching. The configuration-import leg is the worrying one: it needs no account at all. Properties on managed-appliance contracts should get written confirmation from their provider of the deployed version.