Barracuda: check six product lines and two different attack conditions
ESG has an unauthenticated bypass; command injection requires an administrator. Canada’s advisory provides six version thresholds to check with your maintainer.
Getting started
Generated image · SecuFocus
At a glance
Key points
Do you maintain a Barracuda appliance? Record its product and full version, then have the applicable updates confirmed. Canada’s Cyber Centre advisory covers six product lines. The two NVD records describe different entry conditions: one bypasses ESG authentication, while the other already requires administrator access.
Start with the product, not a shared version number
Advisory AV26-1112, dated 2 November, identifies versions earlier than the thresholds below. They are not interchangeable: ESG and WAF do not share the same branch. Have the person maintaining the appliance check the patches actually applied as well.
The table reproduces the Canadian advisory’s versions. It does not detail every intermediate hotfix or patch identifier. A displayed version alone therefore does not replace confirmation that the advisory has been addressed for your device.
| Barracuda product | Versions earlier than this threshold are listed |
|---|---|
| Email Security Gateway (ESG) | 9.4.0.030 |
| Load Balancer ADC | 6.4.0 |
| Web Application Firewall (WAF) | 11.0.1 |
| Web Security Gateway (WSG) | 16.1.100.100 |
| Message Archiver (BMA) | 5.5.4.0 |
| WAF Control Center (WCC) | 2.2.1 |
ESG import needs no account; command injection needs an administrator
NVD’s CVE-2026-116606 record describes an authentication bypass in ESG before 9.4.0.030. An unauthenticated remote attacker can invoke a configuration-import function and restore a crafted, compatible backup archive. The documented result is unauthorized modification of the appliance’s global configuration.
CVE-2026-111560 affects certain appliances sharing Barracuda code. NVD describes an authenticated administrator injecting operating-system commands into the timezone field; later processing executes them as root, granting very extensive system privileges. Do not turn that second prerequisite into an unauthenticated attack, or assume both CVEs affect every product line in the same way.
Confirm both patching and administration access
Record the model, version, patches and maintenance arrangement, then have your administrator or provider address the advisory. Prepare a protected configuration backup and a recovery access path before the intervention. Afterwards, check the functions you depend on, such as mail flow or the traffic handled by the appliance. For a managed device, request confirmation of its status rather than installing a file received by email.
As an operational precaution, review who can reach the administration interface and remove unnecessary access while preserving legitimate maintenance. Reduced exposure does not prove patching is complete. The sources read do not establish that your appliance is compromised or that either identifier is actively exploited.
This article uses the Canadian advisory and NVD records. Barracuda’s own bulletin was not read because its domain is outside this watch’s authorised list. Patch identifiers reported by the press are therefore not presented as verified here. SecuFocus tested no appliance or attack.
Check and explore
Sources for this article
Numbers connect each reference to the passages that use it. Dates show when the documentation was consulted.
This article draws on the sources above. The exercises are for you to try on your devices; SecuFocus does not present them as tests carried out by its editorial team. Interfaces and features can change. Method and corrections.
Cite this article
Keep this reference with the article when you save or share it.