Barracuda has released fixes for two vulnerabilities that could be combined to gain root access to an Email Security Gateway appliance. Its 2 November advisory says exploitation requires access to the administrative interface.
CVE-2026-116606 is an authorization bypass affecting Email Security Gateway (ESG). CVE-2026-111560 is command injection affecting ESG, Load Balancer Application Delivery Controller, Message Archiver, WAF Control Center, Web Application Firewall and Web Security Gateway. ESG is the only product the advisory lists as affected by both.
Barracuda assigns scores of 9.3 and 8.6 respectively, while labeling both vulnerabilities High. The advisory does not report exploitation in the wild.
Administrators should restrict management interfaces to trusted internal networks and verify patch installation.
Firmware numbers alone can miss the patch
The vendor’s product-specific remediation hub is the practical starting point. It links separate instructions for all six affected products, rather than one universal upgrade target.
For example, ESG instructions direct customers to firmware 9.4.0.029 or later and explain how to check the installed version under Advanced → Firmware Update. Appliances starting below 9.1 need more than one upgrade step. The Trust Center also lists ESG patches BNSF-40425 and BNSF-40430, selected according to firmware.
Message Archiver guidance makes a different distinction: devices on 5.5.0 through 5.5.4.001 can receive a security patch without their firmware version changing. Devices on 5.2 through 5.4.x need a manual upgrade to 5.5.4.002. Recording only the displayed version would therefore miss an important part of the remediation check.
There are inconsistencies worth resolving before choosing an upgrade target. Canada’s 2 November alert lists ESG versions before 9.4.0.030 as affected, while Barracuda’s ESG instructions identify 9.4.0.029 as containing the patches. Administrators facing that discrepancy should confirm their appliance’s firmware and patch combination with Barracuda Support rather than treat a version number from a summary as proof of protection.
