Exploited in the wildHIGHCISA KEV

Barracuda ESG auth bypass chains to root command injection; both CVEs in CISA KEV

Barracuda ESG's authorization bypass chains with a command injection found in six Barracuda appliance lines. The chain gives root without credentials wherever the Admin UI is reachable. Barracuda and CISA report exploitation. Patch, and take admin interfaces off the internet.

Barracuda Networks Email Security Gateway, WAF, Load Balancer ADC, WSG, Message Archiver, WCCCVE-2026-116606CVE-2026-111560CVSS8.6CWE-78Email
Published Nov 11, 2026

On 2026-11-09 Barracuda reported exploitation at a small number of organizations, and CISA added both CVEs to KEV on 2026-11-10. No actor, IOCs or first-exploitation date have been published 1,2.

Oct 15, 202627 daysNov 11, 2026

What you need to know

  • Barracuda Email Security Gateway (ESG) with a reachable Admin UI is exposed to unauthenticated root. ADC, WAF, WSG, BMA and WCC carry only the command injection, which needs admin access.
  • Barracuda reports exploitation at a small number of organizations. CISA added both CVEs to KEV on 2026-11-10, requires forensic triage and set a 2026-11-13 due date for CVE-2026-111560.
  • Fix with the product-specific patch IDs, e.g. ESG BNSF-40425 or BNSF-40430, and confirm they installed. Barracuda states no fixed firmware number.
  • Remove Admin UI exposure to the internet. For ESG units that were exposed before patching, assume compromise until triage says otherwise.
  • There are no vendor IOCs. Hunt for configuration imports or backup restores you did not start, and for unexpected timezone values in the appliance config.

What's happening

Two Barracuda flaws combine into unauthenticated root code execution on Email Security Gateway (ESG). CVE-2026-116606 is an authorization bypass in ESG. It lets a remote attacker without credentials call the configuration-import function and restore a crafted backup that changes the appliance's global configuration 7. CVE-2026-111560 is an OS command injection in timezone handling. The vulnerable code is shared across several Barracuda appliance products and runs commands as root 4. Barracuda says the pair could let an attacker bypass authorization controls and obtain root on the device 1.

ESG is the only product affected by both CVEs. Load Balancer ADC, WAF, Web Security Gateway, Message Archiver and WAF Control Center are affected only by CVE-2026-111560, so exploiting them requires valid admin access 1. On 2026-11-05 Barracuda revised the advisory to say CVE-2026-116606 needs no credentials. The attacker must still be able to reach the administrative interface 1.

On 2026-11-09 Barracuda updated its advisory to report exploitation affecting "a small number of organizations". It gave no technical details, date or actor 1. CISA added both CVEs to KEV on 2026-11-10, citing evidence of active exploitation, and marked forensic triage as required under BOD 26-04 2,3. SecurityWeek reports that Previdian saw 17 attempts against CVE-2026-116606 from 15 IP addresses in three countries between 2026-11-09 and 2026-11-11 6. No vendor, government or IR firm has named an actor. The Hacker News separates these bugs from CVE-2023-2868, the 2023 ESG campaign tied to UNC4841 8.

How it works

CVE-2026-111560 is OS command injection (CWE-78). The appliance does not neutralize shell metacharacters in the timezone configuration field. A crafted timezone value is later handled by code that executes commands as root 4. Used alone, the flaw requires administrative authentication, and Mandiant rates its exploitability Medium for that reason 1,4. Barracuda scores it 8.6 (High), and Mandiant gives the same score with a CVSS 4.0 vector 1,4.

CVE-2026-116606 affects ESG only. It is an authorization bypass that exposes the configuration-import function to unauthenticated callers. Through that function, an attacker can restore a compatible backup archive they have crafted 7. In the chain, the restored backup carries the malicious timezone value, which the appliance then executes as root through CVE-2026-111560 5,8. The attacker needs network reach to the Admin UI but no credentials 1.

According to watchTowr's patch diff, the fix stops passing the timezone value to a shell and validates it instead 5. Barracuda scores CVE-2026-116606 at 9.3 (High) 1. watchTowr's 9.8 rating for the full chain is its own estimate, not a vendor score 5.

What to do

In order of priority
  1. 1

    Apply the product-specific patches listed in Barracuda's advisory. Confirm the device runs the latest firmware with all security patches. If a patch did not apply automatically, install it manually and re-enable automatic patching 1.

  2. 2

    Devices several firmware versions behind may need more than one update before the fix applies. Barracuda directs these customers to Barracuda Support 1.

  3. 3

    Limit administrative interfaces to trusted internal networks with network access controls, so no Admin UI is reachable from the internet 1.

  4. 4

    Federal agencies must apply vendor mitigations per BOD 26-04 and perform forensic triage, or discontinue use if mitigations are unavailable. The CVE-2026-111560 deadline is 2026-11-13 3.

  5. 5

    Treat any ESG whose Admin UI was reachable from the internet before it was patched as potentially compromised. The first exploitation date is unknown. Triage the device before trusting it again, review the restored configuration, and rotate admin credentials and any secrets stored on the appliance.

  6. 6

    If triage shows tampering, isolate the appliance and engage Barracuda Support and your incident response process before rebuilding it or restoring a configuration.

Detection

  • Barracuda and Mandiant have published no IOCs or detection guidance. CISA requires forensic triage under BOD 26-04 to determine whether a device was compromised before it was patched 2.
  • Inventory every Barracuda Admin UI that is reachable from the internet. ESG units with an exposed Admin UI are the ones open to the pre-authentication chain 1.
  • Validate exposure with watchTowr's detection tool, which The Hacker News describes as a vulnerability check rather than an exploit 5,8. The ProjectDiscovery Nuclei template for CVE-2026-116606 is marked verified: false, so confirm its hits manually 9.
  • Review Admin UI and system logs for configuration-import or backup-restore events that no administrator performed, especially from external IP addresses. The bypass works by abusing configuration import 7.
  • Inspect the current and recently restored configuration for timezone values that contain shell metacharacters or anything other than a standard zone name. The injection is carried in the timezone field 4.
  • On ADC, WAF, WSG, BMA and WCC, exploitation requires admin access 1. Review admin logins for unfamiliar sources or times, and check those products for recent timezone changes.
  • Where appliance telemetry exists, look for unexpected root processes, new persistence or outbound connections that appear after a configuration change or restore.

Timeline

  1. Command injection (CVE-2026-111560) reported, per Mandiant's disclosure timeline. 4

  2. ESG authentication bypass (CVE-2026-116606) reported, per SecurityWeek citing Mandiant. 7

  3. CVEs published; Barracuda advisory with patches and Mandiant advisory released. 1

  4. Barracuda revises advisory: CVE-2026-116606 needs no credentials, only Admin UI access. 1

  5. watchTowr publishes root-cause analysis of the chain and a detection tool. 5

  6. Barracuda updates advisory to report exploitation at a small number of organizations. 1

  7. CISA adds both CVEs to KEV; CVE-2026-111560 due 2026-11-13 with forensic triage required. 2

  8. SecurityWeek reports Previdian saw 17 attempts against CVE-2026-116606 since 2026-11-09. 6

Sources

  1. 1
    Pre-Authentication Authorization Bypass and Command Injection Vulnerabilities in Certain Barracuda Products
    Barracuda Networks · Vendor · Nov 9, 2026
  2. 2
    CISA Adds Six Known Exploited Vulnerabilities to Catalog
    CISA · Government · Nov 10, 2026
  3. 3
    CISA KEV entry CVE-2026-111560
    CISA · Government · Nov 10, 2026
  4. 4
    MNDT-2026-0041 (CVE-2026-111560)
    Mandiant · Research · Nov 2, 2026
  5. 5
    Barracuda Networks is your new best friend
    watchTowr Labs · Research · Nov 5, 2026
  6. 6
    Recently Patched Barracuda Vulnerabilities Exploited in Attacks
    SecurityWeek · News · Nov 11, 2026
  7. 7
    Barracuda ESG Authentication Bypass Flaw Opens Path to Root
    SecurityWeek · News · Nov 4, 2026
  8. 8
    Experts Demonstrate Barracuda Email Security Gateway Chain Enabling Root Access Without Login
    The Hacker News · News
  9. 9
    Nuclei template CVE-2026-116606
    ProjectDiscovery · Database

Confirmed by vendor and government. Researched and drafted by the VulnDigest briefs agent from 9 sources, then checked against them by a separate review step on Nov 11, 2026.

The headline CVSS 8.6 and its vector apply to CVE-2026-111560. Barracuda scores CVE-2026-116606 at 9.3 (High) and does not publish a vector for it.

The fixed ESG firmware number is disputed: watchTowr says 9.4.0.029, while THN, SecurityWeek/Mandiant and Nuclei say 9.4.0.030. Barracuda gives only patch IDs, so the brief lists patch IDs.

Version ranges such as ESG <=9.4.0.27 come from the Mandiant/CNA record, not the vendor advisory, so the brief omits them. The ESG range also appears inconsistent with the vendor's 9.4.017+ patch wording.

Previdian's attempt counts come only from SecurityWeek. The KEV details (due date, forensic triage) come from CISA's KEV feed data.

We could not confirm whether a public exploit is available. watchTowr published an analysis and a detection tool.

Barracuda has not said which products or CVEs were exploited, or when exploitation began. Zero-day status and exploitation of the non-ESG products are unknown.

Spotted an error? Open an issue on sochub.io.