PolicyCortex
Request Access
Summary
  • Barracuda published the advisory on November 2, 2026.
  • The gateway bypass scores 9.3. The command injection scores 8.6.
  • Chained on Email Security Gateway, the pair could yield root access.
  • Barracuda says exploitation needs access to the admin interface.

What Barracuda published on November 2

Barracuda Networks published a security advisory on November 2, 2026. The title is Pre-Authentication Authorization Bypass and Command Injection Vulnerabilities in Certain Barracuda Products. The advisory covers two flaws. The first is CVE-2026-116606. The second is CVE-2026-111560. Mandiant is the CVE Numbering Authority (CNA) for both records. Mandiant scores the first flaw 9.3 under Common Vulnerability Scoring System (CVSS) version 4.0. It scores the second flaw 8.6 under the same version.

How the chain works

The first flaw is an authorization bypass in Email Security Gateway (ESG) only. ESG is the mail gateway product. The second flaw is operating system command injection. It affects six products in total. On ESG, the two flaws can chain. Barracuda says the pair could allow bypassing authorization controls and obtaining root access. Root access means full control of the device. The other five products take the command injection flaw only. They do not take the full chain, because they lack the bypass flaw.

Read the auth detail closely

This advisory needs a close read. The title calls the first flaw pre-authentication. That phrase suggests no login is needed. The advisory detail says something different. For both flaws, it lists Authentication Required as Yes, administrative access. The overview also says successful exploitation requires access to the administrative interface. These statements do not line up cleanly. Do not claim unauthenticated root access as settled fact. Treat admin interface exposure as the key risk factor. Restrict admin access to trusted networks now. Then read the full advisory before you judge any one device.

Which products and patches

For ESG, Barracuda lists patch BNSF-40425 for 9.4.017 and higher. It lists patch BNSF-40430 for releases below 9.4.017. Record summaries put affected ESG builds before 9.4.0.030. The safest course is the latest firmware offered for your device. Load Balancer ADC and Web Application Firewall take patch BNADC-16586. Message Archiver takes patch BNMA-32468. WAF Control Center takes patch BNWF-60060. Web Security Gateway takes patch BNYF-24789. If automatic patching is off, apply the patch by hand at once. Confirm the new version after install.

What is not reported

Barracuda has not reported exploitation in the wild for either flaw. That fact lowers urgency, but it does not remove it. A 9.3 score on a gateway product is enough to move fast. Neither flaw was in the CISA Known Exploited Vulnerabilities (KEV) catalog as of November 3, 2026. KEV is the Cybersecurity and Infrastructure Security Agency (CISA) exploited list. A future listing would raise priority again. Watch for it.

The governance lesson

A gateway sits at the edge of trust. Mail flows through it. Admin access to it must be narrow. This case shows why an inventory must list admin exposure, not just version numbers. A patch record that omits admin exposure misses the real risk. Record the product, the version, and the patch. Record whether the admin interface faces the internet. Record the date you closed that exposure. That record turns a patch ticket into proof.

Sources

Next step

Patch your Barracuda products to the latest firmware, then confirm admin interfaces are not open to the internet.

Questions on this record
Which products are affected?
Email Security Gateway takes both flaws. Five more products take the command injection flaw only. They are Load Balancer ADC, Message Archiver, WAF Control Center, Web Application Firewall, and Web Security Gateway.
Is this an unauthenticated root flaw?
Do not treat that as settled. Barracuda titles the first flaw pre-authentication. Its detail says administrative access is required. Read the advisory closely and restrict admin access.
Has Barracuda reported exploitation in the wild?
No. Barracuda has not reported exploitation in the wild. Neither flaw was in the CISA exploited list as of November 3, 2026.
What is the safest patch step?
Move to the latest firmware offered for your product. Apply the named patch for your product line. Confirm the patch with a version check.

Related records

Guides and articles describe the work. The evidence that work produces is described in three proof pages and one architecture page.

proof.state
Proof of State. What the environment was, as of a date someone else picks: point-in-time records, content hashed and chained.
proof.change
Proof of Change. Who or what altered the environment, under what authority, with before and after state hashes.
proof.agency
Proof of Agency. What a machine was permitted to do before it acted, what it did, and what would have stopped it.
architecture
Architecture. How the chain is built and where it lives: inside your tenant, with no egress of evidence.

Further reading in this register

  1. WordPress Upgrade Window Flaw Joins the Exploited ListCISA added the WordPress upgrade window flaw to its exploited list on November 3, 2026. Sites must move to 7.1.4 or a patched branch release, then check for signs of entry.5 min
  2. cPGuard Update Channel Compromise: Malicious Script in Updates 5.88.12 to 5.88.19A compromised update channel sent a malicious script to cPGuard servers. Update to 5.88.25 or later, check the indicators, and rotate exposed secrets.5 min
  3. Langflow Flaws Let Attackers In Without an AccountTwo flaws in Langflow score 9.8. An attacker needs no account to bypass checks or run code through agent tools.3 min

Verify the record this entry describes.

Request AccessBook a call
Published
Last updated
Unchanged since publication
Author
Leonard Esere