Barracuda Email Security Gateway Flaws Can Be Chained to Reach Root

Two newly patched bugs in the Barracuda email security gateway can be chained to give an attacker full control of the appliance. Barracuda published fixes on 2 November 2026, and a research team has now explained how the pieces fit together. If your organisation runs one of these boxes, this one needs a look this week.

What Barracuda fixed

Barracuda’s advisory covers two CVEs. CVE-2026-116606 is an authorization bypass rated 9.3 on the CVSS 4.0 scale, and it affects only the Email Security Gateway. CVE-2026-111560 is an operating system command injection rated 8.6. That second flaw is wider: it also touches the Load Balancer ADC, Web Application Firewall, Message Archiver, WAF Control Center and Web Security Gateway, according to a summary of the advisory.

The Canadian Centre for Cyber Security issued its own alert on the same day. It lists the versions that are vulnerable until updated, including ESG firmware before 9.4.0.030.

How the Barracuda email security gateway flaws chain together

On 5 November, the researchers at watchTowr Labs published a teardown of the patches. Their write-up is the clearest account of the mechanism, so it is worth walking through.

The first bug sits in a failed password-change path. The code sends an error response but does not stop processing the request. Instead it hands back the low-privilege login-screen role, so later handlers still run when they should not.

That gives an attacker a route to the backup restore feature. The appliance accepts an uploaded backup archive and restores what is inside, including a database holding the system time zone value. The archive’s integrity check relies on a fixed, hardcoded value, so it protects nothing.

The second bug finishes the job. The time zone value is written into files through shell-backed commands without proper cleaning. A helper script then runs through sudo, so whatever an attacker smuggled into that value runs as root.

Why attackers want a mail gateway

Think about what the Barracuda email security gateway sees. Every inbound and outbound message passes through it. Staff mail, invoices and password resets all land there first. Root access on the box means an attacker can read that traffic, change it, or use the gateway as a quiet foothold inside the network.

That is why we treat these devices as servers in a test. They run privileged code, and they usually sit where the internet meets the office.

Is anyone exploiting it?

Not as far as anyone has reported. The advisory does not say either flaw has been used in attacks, and no public confirmation of exploitation had appeared when the main write-ups went out.

History is the reason not to relax. Attackers exploited an earlier ESG bug, CVE-2023-2868, as a zero-day, and the group tracked as UNC4841 was behind that campaign. The new flaws are not related to it, but they show the same appeal. A mail gateway sees every message, sits at the network edge and often holds credentials, which makes it a rich target.

There is also a point of disagreement in the sources. watchTowr describes the chain as reachable before login. Other summaries say exploitation needs access to the administrative interface. We cannot settle that from the outside, so plan for the worse case.

What UK organisations should do now

Start by finding out whether you own one. Smaller firms often have a gateway that a managed provider installed years ago and nobody has touched since. Then work through this list:

• Confirm the firmware version and apply the patch. Barracuda lists BNSF-40425 for firmware 9.4.017 and later, and BNSF-40430 for older releases.
• Expect more than one update if the device is several versions behind.
• Check that automatic patching has not been switched off. Barracuda says to restore it to the default.
• Take the admin interface off the internet. Limit it to trusted internal networks.
• Review the device for unexpected backup restores or configuration changes.

One wrinkle: Barracuda’s documentation names 9.4.0.029 as the fixed release, while the CVE record points to 9.4.0.030. Install the newest firmware available and do not stop at the lower number.

The wider lesson

Security appliances rarely get the same scrutiny as laptops and servers, yet they run privileged code and face the internet. We made the same point after the Cisco email gateway vulnerability, and again when attackers hit FortiMail with a zero-day. Patching them promptly is part of the baseline that Cyber Essentials expects.

Patching is only half of it. A penetration test of your external perimeter should include every management interface, so you learn what an attacker can reach before one finds it for you.