Attackers exploit Barracuda appliance flaw to run commands as root

Wat is er gebeurd

Several Barracuda Networks appliances share code that does not properly clean up the value entered in the timezone configuration field. Someone logged in as an administrator can slip operating system commands into that field. The appliance then runs those commands with root privileges when it later processes the timezone value, giving the attacker full control of the device.

The flaw is being used in real attacks. CISA added it to its Known Exploited Vulnerabilities catalog on 10 November 2026. The Dutch NCSC has also published an advisory, NCSC-2026-0465.

Wie is getroffen

Barracuda Networks lists these products as affected, in each case up to and including the version shown: Email Security Gateway (ESG) 9.4.0.27, Load Balancer Application Delivery Controller (ADC) 6.4.0, Message Archiver (BMA) 5.5.4.0, WAF Control Center (WCC) 2.2.1, Web Application Firewall (WAF) 11.0.1, and Web Security Gateway (WSG) 16.1.100.100.

Barracuda has not said which versions fix the problem, and no fix has been confirmed yet.

Hoe ernstig is het

The flaw carries a CVSS score of 8.6, rated high. An attacker needs administrator credentials first, which limits who can abuse it. Once that hurdle is cleared, the result is root-level command execution on the appliance. Because attackers are already exploiting it, affected devices should be treated as a priority. CISA has set a deadline of 13 November 2026 for US federal agencies to act.

Wat moet u doen

1. 1Follow Barracuda's advisory and apply the mitigations it describes for each affected product.
2. 2Act before 13 November 2026, the CISA deadline, and stop using the product if no mitigation is available, as CISA directs.
3. 3Follow CISA's forensics triage requirements to check affected appliances for signs of compromise.
4. 4Review NCSC-NL advisory NCSC-2026-0465 and monitor Barracuda for fixed versions.

Kerngegevens