Barracuda patches flaws allowing root access to appliances

Barracuda Networks issued an advisory Nov. 3, 2026, on two critical vulnerabilities in its appliances that Mandiant researchers found in core firmware.

The vendor released security fixes Nov. 2, 2026, and administrators should update to version 9.4.0.030 or later without delay. The first flaw, CVE-2026-116606, is a critical authentication weakness in Barracuda’s Email Security Gateway that lets attackers change the appliance’s global configuration without logging in. It affects versions earlier than 9.4.0.030, including all releases through 9.4.0.029. Exploitation requires network access to the appliance and neither privileges nor user interaction, according to IONIX.

The bypass works through the configuration-import function, where an attacker restores a crafted backup archive that the appliance accepts as compatible, allowing changes to core device settings. IONIX notes the CVE record lists no workarounds for this flaw and recommends upgrading to version 9.4.0.030 or later while keeping the administrative interface off the public internet.

The second flaw, CVE-2026-111560, is a command injection vulnerability caused by weak validation of the timezone setting that causes the system to run shell commands as root. Threat actors with administrative permissions can inject operating system commands through it. It affects the Email Security Gateway, Web Application Firewall, Load Balancer ADC, Message Archiver, Web Security Gateway, and WCC.

Chaining the two flaws could let an attacker bypass authorization controls and gain root-level access to the appliance. The highest severity rating is 9.3, assessed as Critical under CVSS version 4.0, with the CVE record carrying the vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. VulDB rates the flaw at 5.3, Medium, below the Critical rating in the CVE record.

Barracuda’s advisory carries the title pre-authentication authorization bypass, command injection and addresses both CVE-2026-116606 and CVE-2026-111560, an OS command injection. Public reporting says an attacker can chain the two flaws to reach root, but neither Barracuda nor Mandiant has released the technical details of the bypass path.

The vendor said there is no confirmed exploitation in the wild and that researchers have published no public proof-of-concept exploit code. Barracuda’s fix summary lists neither flaw as exploited, but some third-party sources remain unclear, so the exploitation status is unconfirmed.

Barracuda said an attacker must reach the administrative interface of an affected product and recommended restricting management access to trusted internal networks. The vendor launched a full remediation effort, issued security patches, and advised customers to update to the newest firmware and install all patches.

“Successful exploitation requires an attacker to have access to the administrative interface of an affected product.” The vendor’s advisory states: “If exploited in combination, these vulnerabilities could allow an attacker to bypass authorization controls and obtain root access to the device.”

Barracuda reports more than 200,000 customers worldwide, including small and midsize businesses, large enterprises, and managed service providers. Shodan telemetry indicates thousands of management portals for these appliances remain reachable on the public internet. Because chaining the flaws gives an attacker full control of the device, system administrators must install the patches immediately.

Barracuda’s advisory says the full inventory of affected devices and their patches appears in a table below the announcement. The company characterized its response as an immediate, comprehensive remediation effort that included issuing security patches for the affected appliances.

Three years ago, Barracuda fixed Email Security Gateway vulnerability CVE-2023-7102 that UNC4841 exploited in zero-day attacks to run arbitrary code on unpatched appliances. In the same year, UNC4841 hackers used zero-day flaw CVE-2023-2868 to target Barracuda Email Security Gateway appliances in cyber-espionage attacks.

Barracuda said attackers exploited CVE-2023-2868 for at least seven months beginning in October 2022 to deploy SeaSpy and Saltwater malware and steal data. The flaw is a remote command injection affecting Email Security Gateway appliances versions 5.1.3.001 through 9.2.0.006 and attackers exploited it as a zero-day from October 2022.

Mandiant said nearly one-third of compromised appliances in the 2023 campaign were government agencies worldwide, with most intrusions from October through December 2022. Industry reporting cited by CISA says attackers first entered victim systems through the vulnerability and then installed backdoors to maintain access.

CISA analyzed backdoor samples from a compromised organization, including SUBMARINE, SKIPJACK, SEASPY, WHIRLPOOL, and SALTWATER. SUBMARINE is a persistent backdoor running with root privileges from a SQL database on the Email Security Gateway appliance. SEASPY is a passive backdoor posing as a legitimate Barracuda service that opens a TCP reverse shell to its command and control server. SALTWATER is a backdoor that performs DNS resolution and communicates over the network using TLS version 1.

CISA says the actors delivered the CVE-2023-2868 exploit payload using a phishing e-mail with a malicious attachment. SUBMARINE comprises artifacts including a SQL trigger, shell scripts and a loaded library for a Linux daemon, enabling root-level execution, persistence, command and control, and cleanup. SALTWATER can perform DNS resolution and establish network communications using a TLS version 1 connection, and the malware can run any shell command with the same privileges as the process that calls it.

CISA describes WHIRLPOOL as a backdoor that connects to a remote address and creates a new process, and as one that establishes a Transport Layer Security reverse shell to the Command-and-Control server. CISA says SEASPRAY is a backdoor that sets up an event handler for all incoming email attachments and serves as a launcher for WHIRLPOOL. CISA describes SKIPJACK as a backdoor that enumerates file system information.

IONIX advises upgrading Barracuda ESG to version 9.4.0.030 or later and confirming that Firmware Patches are enabled. CISA provides contact details for reporting suspicious or criminal activity tied to the malware analysis reports: CISA’s 24/7 Operations Center at Report@cisa.gov or 1-844-Say-CISA (1-844-729-2472).