Barracuda Email Gateway Flaws Could Give Attackers Root Access

A pair of vulnerabilities in Barracuda’s Email Security Gateway can be chained to give an attacker root access without logging in, provided the attacker can reach the appliance’s administrative interface. Barracuda has issued patches and updated its advisory to clarify this important condition.

The first flaw, CVE-2026-116606, is a pre-authentication authorisation bypass in the Email Security Gateway. The second, CVE-2026-111560, is a command-injection flaw affecting several Barracuda products. Used together against a reachable gateway admin interface, they can allow an attacker to bypass access controls and run commands with root privileges. Barracuda rates the flaws high severity, with CVSS scores of 9.3 and 8.6 respectively.

Barracuda corrected its advisory on 5 November to say that authentication is not required for the first vulnerability. That does not mean every email gateway is remotely exploitable from anywhere. The attacker still needs access to its admin interface, which is why the interface’s exposure and access controls matter so much.

Barracuda says Email Security Gateway systems need patches BNSF-40425 for firmware 9.4.017 and newer, or BNSF-40430 for older versions. The command-injection flaw also affects its Application Delivery Controller, Message Archiver, WAF Control Centre, Web Application Firewall and Web Security Gateway, each with its own patch. Administrators should verify the exact product and firmware version rather than assuming a single update covers every appliance.

The company’s guidance is to restrict administrative interfaces to trusted internal networks, confirm that devices are running current firmware and ensure patches have been applied. Organisations that disabled automatic patching should install the relevant fixes manually. A device several versions behind may need more than one upgrade, Barracuda cautions.

For security teams, the immediate question is whether an affected admin interface is exposed to the internet or to a broader network than intended. Restricting access reduces the attack path, but it should accompany patching, not replace it. Teams can also review access logs and configuration changes for unexpected activity, while following their normal incident-response process if compromise is suspected.

Barracuda’s advisory does not establish that these flaws have been exploited in the wild. The issue is nevertheless significant because an email security gateway sits on a sensitive boundary; it handles the organisation’s incoming communications and may be deeply integrated with its network. The safest response is to confirm exposure and patch status promptly, then document the checks for the affected estate.

This is another reminder that an appliance sold as a security product is still software that requires maintenance. The details are in Barracuda’s product-specific advisory, which administrators should consult for the latest versions and remediation steps.