Critical Vulnerability Chain in Barracuda Networks Appliances (CVE-2026-116606 and CVE-2026-111560)

The security risk stems from a critical vulnerability chain affecting multiple Barracuda appliances running shared backend components:

• CVE-2026-116606 (CVSS 9.3) - Authentication / Authorization Bypass: An authentication bypass flaw via an alternate path or channel exists within the appliance Administrative User Interface (Admin UI). An attacker with network reachability to the Admin UI can invoke privileged configuration routines and administrative actions without presenting valid authentication credentials.

• CVE-2026-111560 (CVSS 8.6) - OS Command Injection: An improper neutralization of shell metacharacters vulnerability exists within the system timezone configuration handler. When input parameters containing crafted shell sequences are submitted to this routine, they are passed unsanitized to the underlying operating system shell, executing commands with root privileges.

Exploitation Chain: Although CVE-2026-111560 normally requires administrative privileges to reach the affected configuration parameters, threat actors chain CVE-2026-116606 to bypass authentication entirely. By sending crafted unauthenticated requests to the Admin UI, attackers inject arbitrary OS commands into the timezone or related configuration settings, executing malicious payloads directly as root.

Confirmed in-the-wild exploitation has targeted internet-exposed appliances to establish backdoors, harvest internal email traffic, and gain persistence within corporate perimeters.

• Barracuda Email Security Gateway (ESG) versions prior to 9.4.0.030;
• Barracuda Load Balancer Application Delivery Controller (ADC);
• Barracuda Message Archiver (BMA);
• Barracuda Web Application Firewall (WAF);
• Barracuda Web Security Gateway;
• Barracuda WAF Control Center.