Barracuda products have pre-auth bypass and command injection flaws
Original title: Barracuda Networks security advisory (AV26-1112)
Six Barracuda gateways and management products below stated builds are affected; the Cyber Centre says updates are available.
On November 2, 2026, the Canadian Centre for Cyber Security said Barracuda Networks products are affected by pre-authentication authorization bypass and command injection vulnerabilities. Affected lines include Email Security Gateway, Load Balancer ADC, Web Application Firewall, Web Security Gateway, Message Archiver, and WAF Control Center, each below a stated build. The centre urges administrators to review Barracuda's links and apply updates as they become available.
Unconfirmed: The alert does not say whether the flaws are being exploited.
- ESG before 9.4.0.030 and ADC before 6.4.0 are listed.
- WAF before 11.0.1 and WSG before 16.1.100.100 are listed.
- Message Archiver before 5.5.4.0 and WCC before 2.2.1 are listed.
- The alert serial number is AV26-1112, dated November 2, 2026.
Impact: Pre-authentication authorization bypass and command injection
| Product | Affected | Fixed in |
|---|---|---|
| Barracuda Networks Email Security Gateway (ESG) | Prior to 9.4.0.030 | 9.4.0.030 |
| Barracuda Networks Load Balancer Application Delivery Controller (ADC) | Prior to 6.4.0 | 6.4.0 |
| Barracuda Networks Web Application Firewall (WAF) | Prior to 11.0.1 | 11.0.1 |
| Barracuda Networks Web Security Gateway (WSG) | Prior to 16.1.100.100 | 16.1.100.100 |
| Barracuda Networks Message Archiver (BMA) | Prior to 5.5.4.0 | 5.5.4.0 |
| Barracuda Networks WAF Control Center (WCC) | Prior to 2.2.1 | 2.2.1 |
- 1.Review Barracuda's security advisories and apply the listed product updates.
From the original article
1 min read at cyber.gc.ca
Serial Number: AV26-1112 Date: November 2, 2026 As of November 2, 2026, Barracuda Networks is affected by a vulnerability in the following products: Barracuda Email Security Gateway (ESG) Prior to 9. 4. 0.
cyber.gc.ca
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.