Barracuda published fixes on November 2, 2026 for two vulnerabilities in its appliance products. In combination on an affected Email Security Gateway, the flaws can let an attacker bypass authorization and obtain root access. A November 5 clarification makes the administrative interface’s exposure especially important.
Access to the page is not an authenticated session
The vendor’s update says CVE-2026-116606 does not require authentication, although the attacker must be able to reach the administrative user interface. An earlier description saying administrative access was required could be read as requiring a valid login. The corrected wording removes that ambiguity.
The authorization bypass affects Email Security Gateway. CVE-2026-111560, the command-injection flaw, affects that product and five other named appliance families: Load Balancer ADC, Message Archiver, WAF Control Center, Web Application Firewall, and Web Security Gateway. The advisory does not say every product has the same complete unauthenticated chain.
Independent disclosure describes the bypass
Mandiant’s November 2 advisory says an unauthenticated remote attacker can restore a crafted compatible configuration backup on affected ESG versions, modifying the appliance’s global configuration. It identifies versions earlier than 9.4.0.030 as affected by the bypass and assigns a CVSS 4.0 score of 9.3.
The Canadian Cyber Centre’s same-day advisory separately lists affected product versions and directs operators to vendor updates. Because firmware and patch delivery are related but separate records, the current Barracuda remediation table is the reference for the exact product-specific patch.
Verify the device’s patch state
Barracuda advises current firmware and all applicable security patches, including manual application when automatic patching did not occur. It notes that a device several firmware versions behind may need multiple update steps and recommends contacting support for assistance.
Our operational analysis is to capture both firmware version and installed patch state for each appliance. A dashboard showing that automatic updates are enabled is a configuration fact, not evidence that the necessary patch reached a particular device.
Reduce exposure without losing control
Identify who can reach management interfaces from outside their intended administration network. Account for alternate hostnames, cloud security rules, supplier access, and emergency support paths. A protected user-facing service does not establish that its management interface has the same boundary.
Apply access restrictions through the organization’s established network-management process, with a tested authorized route remaining available. That avoids replacing exposure with an accidental lockout during urgent maintenance. Then confirm from the relevant network locations that the intended boundary is enforced.
Where suspicious activity is present, preserve logs and involve incident responders before treating an update as closure. These advisory facts establish a serious vulnerability and a patching priority; they do not, by themselves, establish a particular organization’s compromise or an active campaign against every installed appliance.