Barracuda Confirms Exploitation of Two ESG Flaws That Chain to Root

An attacker who can reach the administrative interface of a Barracuda Email Security Gateway (ESG) can chain two flaws, CVE-2026-116606 and CVE-2026-111560, into commands running as root, and Barracuda said on Monday, November 9 that someone is already doing it to "a small number of organizations." CISA added both to its Known Exploited Vulnerabilities (KEV) catalog on November 10 and gave federal civilian agencies until November 13 to act.

The fix is not new. Barracuda shipped patches about a week before it confirmed exploitation, according to BleepingComputer, and appliances with automatic patching enabled should already have it.

What the two bugs do (CVE-2026-116606 and CVE-2026-111560)

CVE-2026-116606 is an authentication bypass in the ESG only. CISA's catalog entry says an unauthenticated remote attacker can invoke a configuration-import function and restore a crafted, compatible backup archive, which changes the appliance's global configuration. SecurityWeek lists it at CVSS 9.3 and says Mandiant puts the affected range at versions before 9.4.0.030.

CVE-2026-111560 is an OS command injection in the timezone setting, in code shared across six products. SecurityWeek lists it at CVSS 8.6. CISA describes it as letting an authenticated administrator inject commands that run with root privileges when the crafted timezone value is processed. The bypass supplies the administrator access that the injection needs.

Product	CVE-2026-116606	CVE-2026-111560	Patch ID
Email Security Gateway	Yes	Yes	BNSF-40425 (9.4.017 and later), BNSF-40430 (earlier)
Load Balancer ADC	No	Yes	BNADC-16586
Web Application Firewall	No	Yes	BNADC-16586
Message Archiver	No	Yes	BNMA-32468
WAF Control Center	No	Yes	BNWF-60060
Web Security Gateway	No	Yes	BNYF-24789

The preconditions are disputed

The 8.6 score for the command injection looks high for five of the six products and low for one. Barracuda's advisory says "successful exploitation requires an attacker to have access to the administrative interface of an affected product," as quoted by BleepingComputer. For the five products affected only by the command injection, that is the whole story: no administrator access, no root.

For the ESG, Mandiant and Barracuda disagree. Mandiant describes the bypass as exploitable without authentication, and CISA's entry uses the word "unauthenticated" as well, so an ESG whose management interface faces the internet needs no credentials at the first step. Barracuda's wording puts the bar at reachability of the admin interface, which is the same exposure by a different name. No published account says how many appliances expose that interface.

Timeline

• October 15, 2026: Barracuda received the command injection report, according to Mandiant as cited by SecurityWeek.
• October 22: Barracuda received the authentication bypass report.
• About November 2: patches released.
• November 4: SecurityWeek published; neither advisory then said whether the flaws were exploited.
• November 9: Barracuda updated its advisory to say exploitation was under way.
• November 10: CISA added both CVEs to KEV, with a November 13 due date.

From the authentication bypass report to a patch took about 11 days. From the patch to Barracuda's confirmation of exploitation took about a week.

What to do

Apply the patch for each product in the table, manually if automatic updates did not land. Barracuda also advises restricting the admin interface to trusted internal networks. CISA's entry flags both CVEs for forensic triage, which means patching alone does not settle whether an appliance was already compromised.

No source names the attackers or counts victims. BleepingComputer recalls that the ESG was the target of the UNC4841 espionage campaign in 2023, which Mandiant said hit government agencies for almost a third of breached systems, but nothing published so far ties this activity to that group. The Terminal has also covered Apache httpd 2.4.71's mod_http2 flaw and the Chainstack intrusion through an exposed Grafana MCP server.

The next fixed date is November 13, when federal agencies' deadline for both Barracuda CVEs passes.