Barracuda auth bypass & cmd inj

Barracuda Email Security Gateway

Two vulnerabilities in Barracuda products could allow an attacker to bypass authorization controls and gain root access.

Do this now

Check the vendor's advisory for a fix and restrict administrative access to Barracuda products meanwhile.

First seen: 3 Nov 2026
Last update: 3 Nov 2026, 17:17 UTC
Versions per the CVE record from Mandiant, not the vendor: 9.4.0.030
Identifiers: CVE-2026-116606
CVSS: 9.3
Source: news
On the menu as: VPN & firewalls

Check this repository for exposure to one security incident from pwned.coffee. Report first, change nothing until I say so.

## Barracuda auth bypass & cmd inj
Severity: critical. Patch status: fix status unknown.
Affected: Barracuda Email Security Gateway
Versions per the CVE record from Mandiant, not the vendor: 9.4.0.030
Ids: CVE-2026-116606

Two vulnerabilities in Barracuda products could allow an attacker to bypass authorization controls and gain root access.

## Steps
1. This touches infrastructure (vpn-edge). Look in terraform, ansible, cloud-init, Dockerfiles and docs for the product and version we run. If it isn't in the repo, say so and list what a human should check on the box.
2. Versions per the CVE record from Mandiant, not the vendor: Barracuda Email Security Gateway (ESG): 9.4.0.030. Don't treat them as a fix until the vendor says so.

## Fix by release line
| Line | State | Fix | Until then |
|---|---|---|---|
| Barracuda Email Security Gateway (ESG) | per the CVE record from Mandiant, not the vendor | 9.4.0.030 | restrict network access to it |

## Report
A table: file, product or package, version in use, affected yes/no, exact fix. Then anything a human has to check outside the repo.

If you have the pwned.coffee MCP server (https://pwned.coffee/mcp), call lookup_cve("CVE-2026-116606") for the latest, and check_repo with this repo's lockfiles, Dockerfiles and workflows for a full receipt.
Sources: https://thehackernews.com/2026/11/barracuda-flaws-could-be-chained-to.html
https://pwned.coffee/i/barracuda-auth-bypass-cmd-inj-cve-2026-116606

Timeline

3 Nov 2026, 17:17 UTC
Fix status: no fix yet → unknown.
3 Nov 2026
First reported.

Receipt

Exploitation: No known exploitation
Checked by hand “Tag only: the CVE record names Barracuda Email Security Gateway (ESG).” source
By release line, per the CVE record from Mandiant, not the vendor: Product Affected Version named Source
Barracuda Email Security Gateway (ESG) before 9.4.0.030 9.4.0.030 CVE record (CNA) per the CVE record from Mandiant, not the vendor checked 3 Nov
Score: CVSS 9.3 (critical). CVSS 4.0 9.3 (CNA Mandiant) for CVE-2026-116606
Last checked: 4 Nov 2026, 08:18 UTC

Product	Affected	Version named	Source
Barracuda Email Security Gateway (ESG)	before 9.4.0.030	9.4.0.030	CVE record (CNA) per the CVE record from Mandiant, not the vendor checked 3 Nov

Sources: KEV – CVE record ✓ Vendor –

Sources

feeds.feedburner.com: Barracuda Flaws Could Be Chained to Bypass Authorization and Gain Root Access

Totalone very hot coffee