Pre-Authentication Authorization Bypass and Command Injection Vulnerabilities in Certain Barracuda Networks Products
Overview
Barracuda Networks has identified two vulnerabilities affecting certain Barracuda Networks products: a pre-authentication authorization bypass vulnerability and a command injection vulnerability. The vulnerabilities have been assigned CVE-2026-116606 and CVE-2026-111560, respectively.
Successful exploitation requires an attacker to have access to the administrative interface of an affected product. If exploited in combination, these vulnerabilities could allow an attacker to bypass authorization controls and obtain root access to the device.
Barracuda Networks immediately initiated a comprehensive remediation process and released security patches for affected products. Customers should review the affected products and remediation guidance below, ensure their systems are running the latest firmware version, and have all security patches applied.
Affected versions of Email Security Gateway
All versions of the Email Security Gateway (ESG).
Has Barracuda Networks released a patch?
Yes. Barracuda Networks released firmware version 9.4.0.029, which includes the patches. For appliances running firmware 9.1 through 9.4.0.027, a firmware update has been released.
Appliances should upgrade to 9.4.0.029 and above. After the update, verify that the appliance reports firmware version 9.4.0.029 or later.
Log in to the Email Security Gateway web interface as an administrator.
Go to Advanced > Firmware Update.
Check the Current Installed Version.
If the appliance is running 9.1.x through 9.4.0.17, the security update installs the patch.
Alternatively click Update to upgrade to firmware 9.4.0.029.
Note: If you are starting from a firmware version below 9.1, you must update in two steps. You cannot jump directly to 9.4.0.029. Click the Update button to upgrade the latest version available to you.Allow the upgrade to complete and reboot the appliance if prompted.
After the appliance is back online, return to Advanced > Firmware Update and confirm the installed version is 9.4.0.029 or later.
If it is still below version 9.4.0.029, repeat steps 5 – 7 until the installed version is 9.4.0.029 or later.
How do I confirm whether my appliance has received the security update?
Log in to the Email Security Gateway web interface.
Go to Advanced > Firmware Update.
Check the Current Installed Version.
If the appliance is running firmware version 9.4.0.029 or later, the appliance has received the update.
If the appliance is running an earlier affected firmware version, follow the steps in Action required (above) to update the appliance to firmware 9.4.0.029, then repeat this confirmation process after the appliance restarts.
Additional resources
Contact Barracuda Networks Technical Support for any additional questions.