---
title: Barracuda patches an Email Security Gateway auth bypass (CVE-2026-116606) that chains with a root command injection (CVE-2026-111560) shared by ESG, ADC, WAF, WSG, Message Archiver and WAF Control Center | ctxsec
url: https://ctxsec.com/items/barracuda-esg-cve-2026-116606-111560-auth-bypass-root-nov-2
description: "Barracuda disclosed two bugs on Nov 2. CVE-2026-116606 is a pre-authentication authorization bypass in the Email Security Gateway; CVE-2026-111560 is a command injection in the timezone setting that runs as root and affects six appliance lines. Barracuda says chained together they give root on the device, but only for an attacker who can reach the administrative interface. Patches are out; ESG should be on firmware 9.4.0.029 or later. Barracuda reports no exploitation so far."
status: "official (Barracuda Trust Center / Campus advisories, Nov 2); no exploitation reported, not in CISA KEV as of catalog 2026.10.30"
published: 2026-11-02
---

> Barracuda disclosed two bugs on Nov 2. CVE-2026-116606 is a pre-authentication authorization bypass in the Email Security Gateway; CVE-2026-111560 is a command injection in the timezone setting that runs as root and affects six appliance lines. Barracuda says chained together they give root on the device, but only for an attacker who can reach the administrative interface. Patches are out; ESG should be on firmware 9.4.0.029 or later. Barracuda reports no exploitation so far.

[← Cybersecurity News](/news) · [markdown](/items/barracuda-esg-cve-2026-116606-111560-auth-bypass-root-nov-2.md)

official (Barracuda Trust Center / Campus advisories, Nov 2); no exploitation reported, not in CISA KEV as of catalog 2026.10.30

2026-11-02

### Barracuda patches an Email Security Gateway auth bypass (CVE-2026-116606) that chains with a root command injection (CVE-2026-111560) shared by ESG, ADC, WAF, WSG, Message Archiver and WAF Control Center

- **CVE-2026-116606** (ESG only, CVSS 4.0 9.3 per the CVE record): pre-authentication authorization bypass. Third-party write-ups citing the CVE record say it lets an unauthenticated attacker invoke the configuration-import function and restore a crafted backup.
- **CVE-2026-111560** (CVSS 4.0 8.6): OS command injection via the timezone configuration field, executed as root. Affects Email Security Gateway, Load Balancer ADC, Web Application Firewall, Web Security Gateway, Message Archiver and WAF Control Center.
- **Barracuda's framing:** exploitation requires access to the administrative interface; combined, the two bugs bypass authorization controls and yield root.
- **Fix:** ESG firmware **9.4.0.029** or later per Barracuda's Campus article (the CVE record lists the bypass as fixed in 9.4.0.030, so going to the newest build available is the safe choice). ADC, WAF, WSG, BMA and WCC receive product-specific patches; on ADC 6.4 through 6.6.0.009 the patch installs automatically if automatic firmware patches are enabled.

**What to do:** confirm each appliance's installed firmware under Advanced > Firmware Update, apply the patches, and make sure admin interfaces are not reachable from the internet. Barracuda ESG has a history of being targeted by state actors (the 2023 CVE-2023-2868 campaign), so exposed admin panels deserve a look now even though no exploitation is reported.

Sources: [Barracuda Campus: Security Updates Available for Certain Barracuda Products (Nov 2)](https://documentation.campus.barracuda.com/wiki/spaces/CP/pages/960921759/Security+Updates+Available+for+Certain+Barracuda+Products) · [Barracuda Campus: ESG pre-auth authorization bypass and command injection](https://documentation.campus.barracuda.com/wiki/spaces/BSFv51/pages/963739728/Pre-Authentication+Authorization+Bypass+and+Command+Injection+Vulnerabilities+in+Certain+Barracuda+Networks+Products) · [Barracuda Campus: Load Balancer ADC command injection](https://documentation.campus.barracuda.com/wiki/spaces/LBADCv50/pages/964853772/Command+Injection+Vulnerability+in+Certain+Barracuda+Networks+Products) · [SecurityOnline write-up (Nov 2)](https://securityonline.info/barracuda-vulnerabilities-root-access-patch/)