Barracuda and SonicWall: authentication bypassed

This week, CISA added to its KEV catalog two edge device flaws that go after the same lock: authentication. On November 6, a SonicWall SSL VPN flaw that bypasses SAML-enforced MFA. On November 10, a pair of Barracuda email gateway flaws that, chained together, lead to root access without a password. The Canadian Centre for Cyber Security relayed both.

What happened

Barracuda, two flaws that chain. On November 2, Barracuda published an advisory on two flaws reported by Mandiant:

• CVE-2026-116606, an authentication bypass in Email Security Gateway (ESG), CVSS 4.0 score of 9.3. According to Mandiant, an unauthenticated remote attacker can invoke a configuration-import function and restore a crafted backup archive, which changes the appliance's global configuration;
• CVE-2026-111560, a command injection in the timezone field, score 8.6. It lets an authenticated administrator run commands with root privileges. It affects ESG, but also Load Balancer ADC, Message Archiver, WAF Control Center, Web Application Firewall and Web Security Gateway.

Barracuda says that, combined, the flaws allow an attacker to bypass authorization controls and obtain root access. On November 5, the vendor corrected its advisory: the first flaw does not require authentication, only access to the administrative interface. On November 9, it added that it had observed exploitation affecting "a small number of organizations." The Canadian Centre's advisory AV26-1112 lists the affected versions, including ESG before 9.4.0.030, and CISA added both CVEs to KEV on November 10 with a November 13 deadline and forensic triage required.

SonicWall, SAML MFA bypassed. CVE-2026-19868 affects the SonicOS SSLVPN service. According to the NVD, a user with valid credentials for an alternate authentication method can bypass SAML controls, including SAML-enforced MFA. Help Net Security adds that the flaw can only be exploited when SAML is enabled for SSLVPN logins, that no workaround has been published, and that the fixed Gen7 release is 7.3.4-7013. The Centre's advisory AV26-1133 states that SonicWall reports exploitation. CISA added it to KEV on November 6, with a November 20 deadline.

Why it matters

MFA depends on the device that enforces it. Many organizations solved remote access by connecting the VPN to their identity provider through SAML, with MFA at the end. The SonicWall flaw shows that if the device still accepts another authentication method alongside it, a stolen password can be enough. It is the same lesson as FortiBleed: stolen credentials are in circulation, and every path around MFA eventually gets found.

The admin interface is still the target. For Barracuda, everything goes through the administrative interface. We already wrote about PAN-OS and its exposed management interface: the problem repeats from one vendor to the next. A console reachable from the internet turns a configuration flaw into a full compromise.

An email gateway sees everything. ESG filters inbound and outbound email. An attacker with root control of it sits in the middle of the organization's message flow. CISA's forensic triage requirement targets exactly that risk: applying the patch does not tell you whether someone is already in.

What we think at Sentrix

1. Check exposure first. For each Barracuda and SonicWall device, note whether the admin interface or the SSLVPN portal is reachable from the internet. Our CTEM module keeps this exposure inventory current.
2. Take the admin interface off the internet. Barracuda recommends limiting it to trusted internal networks. Add access through a bastion host or a separate admin VPN, with phishing-resistant MFA.
3. Apply the patches and confirm the version. Barracuda notes that a device several versions behind may need more than one update, and recommends turning automatic patching back on if it was disabled.
4. Disable parallel authentication methods. On SonicWall, if SAML is the official method, make sure no other method, local or LDAP, is still accepted for the VPN. One door, with MFA, is easier to defend.
5. Look for traces before closing the ticket. Imported configurations, unknown accounts or rules, unusual VPN sessions: the ticket closes with the documented search. Our network security service covers these checks.
6. Reset exposed credentials. If a device may have been compromised, the accounts that authenticate through it and the secrets it stores need to change.

The next step

List your edge devices with three columns: vendor, interface exposed or not, authentication methods accepted. Any row with "exposed" and "several methods" needs attention this week. To do the exercise with us, contact us.