Barracuda ESG CVE-2026-116606 Exploited, Added to CISA KEV

Barracuda ESG CVE-2026-116606, a pre-authentication bypass in the Email Security Gateway admin interface, is now exploited in the wild alongside CVE-2026-111560, a root command injection flaw. Barracuda confirmed attacks on "a small number of organizations" on November 9, and CISA added both CVEs to its Known Exploited Vulnerabilities catalog on November 10 with a November 13 deadline. If you run ESG, confirm the patch is installed today and check whether the admin interface was ever reachable from the internet.

What happened

Barracuda published a joint advisory on November 2, 2026 for two flaws. CVE-2026-116606 lets an attacker who can reach the ESG administrative interface invoke a configuration-import function without logging in and restore a crafted backup archive, which changes the appliance's global configuration. CVE-2026-111560 is an OS command injection in the timezone configuration field. An administrator, or anyone who has become one, can place shell characters in that field and get commands executed as root when the value is processed.

Chained, the two give an unauthenticated attacker root on the appliance. Barracuda's own wording: "If exploited in combination, these vulnerabilities could allow an attacker to bypass authorization controls and obtain root access to the device."

The advisory changed twice after release. On November 5, Barracuda corrected the "Authentication Required" field for CVE-2026-116606 from "Yes, administrative access" to "No (Administrative UI Access Required)". On November 9, it added that exploitation had been observed. CISA followed on November 10.

Mandiant published the technical disclosures (MNDT-2026-0042 and MNDT-2026-0041). Its timeline shows Barracuda reported the command injection on October 15 and the bypass on October 22, with CVEs and advisories released November 2. Neither Barracuda nor CISA has named an actor, described the attacks or published indicators of compromise so far.

Who is affected by the Barracuda ESG CVE-2026-116606 chain

Only the Email Security Gateway is affected by the authentication bypass. The command injection sits in code shared by six Barracuda product lines. Barracuda lists these patches:

Email Security Gateway (ESG): both CVEs. Patch BNSF-40425 for firmware 9.4.017 and later, BNSF-40430 for earlier firmware.
Load Balancer Application Delivery Controller (ADC): CVE-2026-111560 only, patch BNADC-16586.
Message Archiver (BMA): CVE-2026-111560 only, patch BNMA-32468.
WAF Control Center (WCC): CVE-2026-111560 only, patch BNWF-60060.
Web Application Firewall (WAF): CVE-2026-111560 only, patch BNADC-16586.
Web Security Gateway (WSG): CVE-2026-111560 only, patch BNYF-24789.

Mandiant's version ranges are stated differently. It lists ESG before 9.4.0.030 as vulnerable to the bypass, and ESG 9.4.0.27 and earlier, ADC 6.4.0 and earlier, WAF 11.0.1 and earlier, WSG 16.1.100.100 and earlier, BMA 5.5.4.0 and earlier and WCC 2.2.1 and earlier for the command injection. Barracuda's table uses patch IDs rather than fixed versions, so trust what the device reports after patching, not a version string from a news story.

On the non-ESG products, the command injection still needs real administrator credentials. That makes it a post-compromise problem there, but anyone with a stolen or shared admin password gets root.

Technical analysis

The bypass is CWE-288, authentication bypass using an alternate path or channel. The login page works, but a second route to a privileged function (configuration import) does not check the session. We explain the pattern in what an alternate path authentication bypass is. Mandiant scores it 9.3 under CVSS 4.0 with no privileges or user interaction required.

The command injection is CWE-78 and scores 8.6 under CVSS 4.0, high only because it requires admin privileges. The two flaws fit together: the first lets an outsider rewrite configuration, the second turns a configuration value into root code execution. Neither step needs a phishing email or a user click.

Exposure is the deciding factor. Barracuda says exploitation requires the administrative interface to be reachable by the attacker. An ESG whose admin UI is open to the internet is exposed to an unauthenticated root compromise. One whose admin UI is reachable only from a management network is much harder to hit.

CISA marked both KEV entries for forensic triage and gave federal agencies three days. That is a short window, and the triage flag says CISA wants agencies to look for compromise, not just patch.

ESG has a history here. In 2023 a China-linked group exploited CVE-2023-2868 on ESG appliances starting in October 2022, and Barracuda told customers to replace compromised devices. Nothing ties the 2026 activity to that group, but appliances that sit at the mail edge with root-level code paths are attractive to the same kind of attacker. Our earlier coverage of the FortiMail CVE-2026-104286 file-write zero-day shows the same targeting of email gateways.

What to do now

Confirm patch status on every ESG, ADC, BMA, WCC, WAF and WSG unit. Barracuda says the device shows the latest firmware available. If automatic patching was turned off, turn it back on and apply the patch manually. Devices several firmware versions behind may need more than one update.
Remove internet access to the admin interface. Barracuda recommends limiting it to trusted internal networks with network access controls. Check firewall rules and any cloud security groups, not just the appliance's own settings.
Treat any ESG whose admin UI was internet-reachable since November 2 as possibly compromised. Patching closes the door but does not undo a configuration that was already replaced.
Review the configuration against a known-good copy. Look for unexpected admin accounts, changed mail routing or relay settings, new forwarding or archive destinations, altered timezone or NTP values, and anything you did not change yourself. Our guide on how to audit appliance configuration changes after an exploit walks through the process.
Rotate credentials stored on or used by the appliance: admin passwords, LDAP or directory bind accounts, SMTP relay credentials and API keys.
If you find signs of tampering, preserve logs and a configuration export before rebuilding, and open a case with Barracuda Support (support@barracuda.com).

For the other five products, focus on who holds admin credentials. Remove shared accounts, check admin login history and restrict the management interface the same way.

What to watch next

Watch for Barracuda or Mandiant publishing indicators of compromise or attribution, and for any change in Barracuda's guidance from "patch" to "replace", as happened in 2023. The fact that one shared function put six product lines at risk is worth a separate look: see why shared code vulnerabilities hit whole product lines. Also watch for CISA marking the entries as used in ransomware campaigns, which is currently listed as unknown.