# Barracuda patches two flaws that can give root access on six products Barracuda fixed CVE-2026-116606 (CVSS 9.3) and CVE-2026-111560 (8.6) on Nov. 2. Security firms report no known exploitation; attackers need admin interface access. By The Signal Edition Newsroom | Cybersecurity / Vulnerabilities Published: 2026-11-04T05:20:00Z Updated: 2026-11-04T05:20:00Z Canonical: https://thesignaledition.com/article/barracuda-patches-two-flaws-root-access-six-products-brc5n2 ## Key points - Barracuda Networks published an advisory and patches on Nov. 2, 2026 for CVE-2026-116606 and CVE-2026-111560, which affect six of its products. - The two flaws are scored 9.3 and 8.6 on the CVSS v4.0 scale, according to Ostorlab and SecurityOnline. - Barracuda said exploitation requires access to a product's administrative interface and advised limiting that access to trusted internal networks. - Ostorlab said no exploitation is known and neither flaw was in the CISA Known Exploited Vulnerabilities catalog as of Nov. 2. ## What Barracuda disclosed Barracuda Networks published an advisory on Nov. 2, 2026 covering two vulnerabilities that can give an attacker root access to six of its security and networking products. The company released patches for each product the same day. [1](https://trust.barracuda.com/security/pre-authentication-authorization-bypass-command-injection) CVE-2026-116606 is an authorization bypass in the Email Security Gateway (ESG). BleepingComputer reported on Nov. 3 that it lets an attacker modify the appliance's global configuration. CVE-2026-111560 is an operating system command injection flaw that runs commands as root for an attacker holding administrator permissions. [2](https://www.bleepingcomputer.com/news/security/barracuda-warns-of-critical-flaws-allowing-root-access-to-devices/) Ostorlab, a security firm, and SecurityOnline both list CVE-2026-116606 at 9.3 and CVE-2026-111560 at 8.6 on the CVSS v4.0 scale, which rates 9.0 and above as critical and 7.0 to 8.9 as high. [3](https://blog.ostorlab.co/barracuda-esg-pre-auth-bypass-cve-2026-116606.html) [4](https://securityonline.info/barracuda-vulnerabilities-root-access-patch/) ## Which products are affected The ESG is affected by both flaws. The Load Balancer ADC, Message Archiver, WAF Control Center, Web Application Firewall and Web Security Gateway are affected by CVE-2026-111560 only, according to the table BleepingComputer reproduced from the advisory. [2](https://www.bleepingcomputer.com/news/security/barracuda-warns-of-critical-flaws-allowing-root-access-to-devices/) The fixes are numbered by product: BNSF-40425 for ESG firmware 9.4.017 and later, BNSF-40430 for ESG firmware below 9.4.017, BNADC-16586 for the Load Balancer ADC and the Web Application Firewall, BNMA-32468 for the Message Archiver, BNWF-60060 for the WAF Control Center and BNYF-24789 for the Web Security Gateway. [2](https://www.bleepingcomputer.com/news/security/barracuda-warns-of-critical-flaws-allowing-root-access-to-devices/) Ostorlab lists ESG versions before 9.4.0.030 as affected by CVE-2026-116606, and ESG 9.4.0.27 and earlier among the versions affected by CVE-2026-111560. [3](https://blog.ostorlab.co/barracuda-esg-pre-auth-bypass-cve-2026-116606.html) ## Is it being exploited Barracuda said successful exploitation requires access to the administrative interface of an affected product. In its advisory, as quoted by BleepingComputer, the company said that if the two flaws are used together they could let an attacker bypass authorization controls and obtain root access. Barracuda advised customers to restrict administrative access to trusted internal networks. [2](https://www.bleepingcomputer.com/news/security/barracuda-warns-of-critical-flaws-allowing-root-access-to-devices/) Ostorlab said no exploitation is known and that neither flaw was in the U.S. Cybersecurity and Infrastructure Security Agency's Known Exploited Vulnerabilities catalog as of Nov. 2. SecurityOnline also lists both as not exploited. The sources describe the access needed differently: Ostorlab calls CVE-2026-116606 a pre-authentication bypass, while Barracuda's own requirement is administrative interface access. [3](https://blog.ostorlab.co/barracuda-esg-pre-auth-bypass-cve-2026-116606.html) [4](https://securityonline.info/barracuda-vulnerabilities-root-access-patch/) ## Why Barracuda email appliances draw attention Barracuda has more than 200,000 customers, BleepingComputer reported. Its ESG appliances were the target of an earlier campaign: CVE-2023-2868 was exploited from at least October 2022 to deploy SeaSpy and Saltwater malware, and Mandiant found that almost a third of appliances compromised in that campaign belonged to government agencies. [2](https://www.bleepingcomputer.com/news/security/barracuda-warns-of-critical-flaws-allowing-root-access-to-devices/) No such activity has been reported for the two new flaws. Administrators who cannot patch immediately have Barracuda's guidance to limit access to the management interface. Barracuda's advisory page was last updated Nov. 2, and any change to the exploitation status would appear there or in the CISA catalog. [1](https://trust.barracuda.com/security/pre-authentication-authorization-bypass-command-injection) [2](https://www.bleepingcomputer.com/news/security/barracuda-warns-of-critical-flaws-allowing-root-access-to-devices/) ## Sources 1. [Barracuda Networks: Pre-Authentication Authorization Bypass and Command Injection Vulnerabilities in Certain Barracuda Products: Updates Available](https://trust.barracuda.com/security/pre-authentication-authorization-bypass-command-injection) (2026-11-02T00:00:00Z) 2. [BleepingComputer: Barracuda warns of critical flaws allowing root access to devices](https://www.bleepingcomputer.com/news/security/barracuda-warns-of-critical-flaws-allowing-root-access-to-devices/) (2026-11-03T10:06:00Z) 3. [Ostorlab: Barracuda ESG Pre-Auth Bypass to Root, Patched (CVE-2026-116606)](https://blog.ostorlab.co/barracuda-esg-pre-auth-bypass-cve-2026-116606.html) (2026-11-02T00:00:00Z) 4. [SecurityOnline: Barracuda Vulnerabilities Allow Full Device Root Access](https://securityonline.info/barracuda-vulnerabilities-root-access-patch/) (2026-11-02T00:00:00Z)