high advisory November 2, 2026

Barracuda Networks: Pre-authentication Authorization Bypass and Command Injection

Multiple Barracuda appliance products are affected by pre-authentication authorization bypass and command injection vulnerabilities that may allow unauthenticated remote attackers to execute arbitrary commands.

Triage facts

Revision 1

Applicability: Email Security Gateway (< 9.4.0.030), Load Balancer Application Delivery Controller (< 6.4.0) +4
Evidence: Unknown
Severity: High
Action: Immediate escalation
Sources: 2 public sources
Freshness: Revision 1Nov 2, 21:22 UTC
Source quality: A1Likely

Barracuda Networks has disclosed multiple security vulnerabilities affecting a wide range of its appliance products. The vulnerabilities are identified as pre-authentication authorization bypass and command injection. Unauthenticated remote attackers may be able to bypass security controls or execute arbitrary system commands on the affected devices.

Recommendation

Prioritize patching of all internet-facing Barracuda appliances to the following minimum versions:

Barracuda Email Security Gateway (ESG): Update to 9.4.0.030 or later.
Barracuda Load Balancer ADC: Update to 6.4.0 or later.
Barracuda Web Application Firewall (WAF): Update to 11.0.1 or later.
Barracuda Web Security Gateway (WSG): Update to 16.1.100.100 or later.
Barracuda Message Archiver (BMA): Update to 5.5.4.0 or later.
Barracuda WAF Control Center (WCC): Update to 2.2.1 or later.

Administrators should monitor appliance audit logs for unusual management interface access attempts or unexpected process execution spawned by web service accounts.

Immediate actions

Apply firmware updates for all affected Barracuda appliances to the provided minimum version levels.

IT Operations 48h

Threat Hunt

Search Barracuda device administrative logs for unauthorized login attempts or abnormal administrative commands executed during the pre-authentication phase.

T1190 high medium confidence hunt now

Data: Barracuda Appliance Audit Logs