Barracuda appliances can be taken over at root
- barracuda
- rce
Barracuda's November 2026 patches close two flaws that, together, can give root on email gateways and other appliances. Apply the firmware patches and keep the admin interface off the public internet.
On 2 November 2026, Barracuda released patches for two flaws in several of its appliances. Used together, they can give an attacker root on the device. The administrative interface has to be reachable. On 9 November, the Canadian Centre for Cyber Security said open-source reporting indicates the authorization bypass is already being exploited.
The bugs
CVE-2026-116606, authorization bypass. On Email Security Gateway, someone who can reach the admin interface does not need an account. Barracuda scores it 9.3. It can change the appliance's global configuration.
CVE-2026-111560, command injection. On Email Security Gateway, Load Balancer ADC, Message Archiver, WAF Control Center, Web Application Firewall, and Web Security Gateway, injected commands can run as root. Barracuda scores it 8.6 and says this one needs administrative access. On Email Security Gateway, the bypass can supply that access.
The remedy
Install the matching patch, then confirm the appliance is on the latest firmware. If automatic patching is off, apply it by hand. A device that is several versions behind may need more than one update.
- Email Security Gateway: BNSF-40425 on 9.4.017 and later, or BNSF-40430 on older releases
- Load Balancer ADC and Web Application Firewall: BNADC-16586
- Message Archiver: BNMA-32468
- WAF Control Center: BNWF-60060
- Web Security Gateway: BNYF-24789
Check the firmware screen after the update, not only that a download finished. On Message Archiver, 5.5.0 through 5.5.4.001 can take a security patch that does not change the displayed firmware version. Releases from 5.2 through 5.4 need a manual upgrade to 5.5.4.002 or later.
If you cannot update today
No setting makes an unpatched appliance safe. Until the patch is installed:
- Keep the administrative interface off the public internet and limit it to a trusted network.
- Turn automatic patching back on so the fix can arrive without a manual window.
- Treat Email Security Gateway first. Both bugs are present there.