Barracuda has confirmed in-the-wild exploitation of two chained Email Security Gateway (ESG) vulnerabilities that give an attacker root on the appliance. CVE-2026-116606 is an authorization bypass that removes the login barrier. CVE-2026-111560 is a command injection that runs commands as root. CISA added both to the Known Exploited Vulnerabilities (KEV) catalog on November 10, 2026. Federal civilian agencies have until November 13, today, to remediate.

If you run a Barracuda ESG, or any of five other Barracuda products, with the admin UI reachable from untrusted networks, treat it as possibly compromised until you have patched it and checked it.

Timeline

  • Early November: Barracuda publishes an advisory and patches for both CVEs. At first, no exploitation was reported.
  • November 5: Barracuda revises the advisory to clarify that CVE-2026-116606 needs no credentials, only network access to the Admin UI. Its CVE table still says “Authentication Required: Yes, administrative access”, which has caused some confusion in coverage. Read that as the admin interface’s attack surface, not a password requirement.
  • November 9: Barracuda updates the advisory: “We have identified exploitation activity affecting a small number of organizations.” It has not said how many customers were hit, which versions they ran, or what attackers did after getting root.
  • November 10: CISA adds both CVEs to KEV with a three-day deadline.

Technical Details

CVE-2026-116606: ESG authorization bypass (CVSS v4 9.3, CWE-288) The flaw sits in the ESG’s configuration-import path. An unauthenticated attacker who can reach the Admin UI can call privileged configuration functionality without a valid session. CWE-288 (authentication bypass using an alternate path or channel) fits: the import route skips the authorization checks that the normal admin workflow enforces. NVD lists every ESG version earlier than 9.4.0.030 as affected. This CVE affects ESG only.

CVE-2026-111560: timezone command injection (CVSS 8.6) A timezone configuration field is passed to a shell without sanitization, so shell metacharacters run with root privileges. On its own it requires admin access. Chained after CVE-2026-116606, it turns an unauthenticated HTTP request into a root shell on the gateway. The vulnerable code is shared across Barracuda’s appliance platform, so it affects six product lines:

ProductCVE-2026-116606CVE-2026-111560Patch
Email Security GatewayYesYesBNSF-40425 (9.4.017+), BNSF-40430 (< 9.4.017)
Load Balancer ADCNoYesBNADC-16586
Web Application FirewallNoYesBNWF-60060 / BNADC-16586
WAF Control CenterNoYesper advisory
Message ArchiverNoYesBNMA-32468
Web Security GatewayNoYesBNYF-24789

On the non-ESG products, CVE-2026-111560 still needs a working admin login. That limits it to post-authentication escalation, or to cases where credentials are weak, reused or already stolen.

Impact

An ESG is a high-value foothold. It sees all inbound and outbound mail, holds TLS keys and often LDAP/AD bind credentials, and usually sits in a DMZ trusted by mail servers on the inside. Root on the gateway lets an attacker read and change mail in transit, harvest credentials, and pivot inward. The 2023 ESG campaign (CVE-2023-2868, UNC4841) showed how persistent that foothold can be: Barracuda eventually told customers to replace compromised appliances instead of cleaning them. Nobody has attributed the current activity yet, but exposed ESG admin interfaces will draw mass scanning now that both bugs are public and in KEV.

Mitigation

  1. Patch now. Move ESG to 9.4.0.030 or later, using BNSF-40425 on 9.4.017+ or BNSF-40430 on older builds. One upgrade fixes both CVEs. Apply the product-specific patches above to ADC, WAF, WAF Control Center, Message Archiver and Web Security Gateway. Confirm each patch is actually installed. Don’t assume auto-update ran.
  2. Lock down the admin UI. Restrict management interfaces to a dedicated management network or VPN. They should never be reachable from the internet.
  3. Hunt for compromise. Barracuda and CISA have not published IOCs. Review Admin UI access logs for unauthenticated configuration-import requests and look for unexpected timezone values containing shell metacharacters. Also check for new admin accounts, configuration changes, unknown processes, cron entries or outbound connections from the appliance.
  4. Rotate secrets stored on or passing through any appliance whose admin UI was exposed before patching: LDAP bind accounts, SMTP relay credentials, TLS private keys and admin passwords.
  5. If you find evidence of compromise, isolate the appliance and contact Barracuda support. Given the 2023 precedent, consider rebuilding or replacing the appliance rather than just patching it.

References