Severity: Critical | Priority: 1
Security researchers have published full technical details of a chain of two flaws in the Barracuda Email Security Gateway. Together, they let an attacker take complete control of the appliance with root privileges, with no username or password. The first flaw, CVE-2026-116606 (rated 9.3 critical), is in the web management interface. When a password-change attempt fails, the interface does not stop processing the request, and it continues with the limited permissions of the login screen. Those permissions are still enough to restore part of the appliance’s configuration from an uploaded backup file. The second flaw, CVE-2026-111560 (rated 8.6 high), is in how the appliance applies its timezone setting. The value is placed into a system command that runs as root without being cleaned, so shell commands hidden in it are executed.
An attacker chains the two in a single web request. The request combines a deliberately failed password change with the upload of a specially built configuration backup. That backup carries a malicious timezone value, which runs the attacker’s commands as root on the appliance. The integrity check on backup files does not stop this, because it relies on a fixed, publicly known value rather than a secret. Barracuda has released fixes, and no attacks have been reported so far. Now that a full write-up and a detection tool are public, exploitation attempts are expected soon. The Barracuda Email Security Gateway has been a major target before: a 2023 flaw in the same product was exploited at scale by a state-sponsored group.
The timezone flaw also affects several other Barracuda products: Load Balancer ADC, Message Archiver, WAF Control Center, Web Application Firewall and Web Security Gateway. On those products, an attacker needs administrator access to exploit it.
Administrators should confirm that every Email Security Gateway has received Barracuda’s fixes, BNSF-40425 for version 9.4.017 and newer or BNSF-40430 for older builds, and is running firmware 9.4.0.030 or later. Apply the matching fixes on the other affected Barracuda products as well, enable automatic updates, and check the firmware version afterwards. Remove the management interface from internet access, and limit it to trusted administrator networks or a VPN. On any appliance whose management interface was exposed, review the configuration import and restore history for imports nobody can account for. Compare the current configuration against a known-good backup, check that the timezone setting contains only a valid timezone name, and look for administrative sessions with no matching successful login. If compromise is suspected, contact Barracuda support, treat the appliance as untrusted, and rotate any credentials or keys stored on it, including those for connected mail servers and directories.