Barracuda ESG Flaws Exploited, How to Close the Root Path

Two flaws in the Barracuda Email Security Gateway (ESG), CVE-2026-116606 and CVE-2026-111560, are now being used in real attacks. Chained together, they give an attacker root access to the appliance. Barracuda confirmed exploitation on November 9, 2026, and CISA added both flaws to its catalog of exploited vulnerabilities a day later. Patches have been available since November 2.

How the Barracuda ESG flaw chain works

The Barracuda Email Security Gateway is a filtering appliance that sits in front of an organization’s mail server. It inspects every inbound and outbound message to catch spam, phishing, and malicious attachments. Because it sits in the path of all email, an attacker who controls it is in a position to read, alter, or forward mail.

The first flaw, CVE-2026-116606, is an authorization bypass found only in the ESG. According to Mandiant disclosure MNDT-2026-0042, an unauthenticated attacker can call a configuration-import function and restore a crafted backup archive, which changes the appliance’s global configuration. Mandiant scores it 9.3 on CVSS. It affects ESG versions earlier than 9.4.0.030.

The second flaw, CVE-2026-111560, is an operating system command injection in the timezone configuration field. According to Mandiant disclosure MNDT-2026-0041, a signed-in administrator can insert commands that later run with root privileges when the timezone value is processed. It scores 8.6. The vulnerable code is shared by six Barracuda products.

On products other than the ESG, the second flaw still requires an administrator account. On the ESG, the first flaw removes that requirement. The Hacker News reported on an analysis by security firm watchTowr: a failed password-change request hands the attacker a low-privilege role, which leaves the backup-restore function reachable without signing in. The restored backup can carry a timezone value containing a command, which the appliance then runs as root.

watchTowr also found that Barracuda’s backup checksum relies on a secret built into the code, so an attacker can forge a checksum the appliance accepts. The researchers proved the chain by writing a file to the appliance as root. As of the report on November 6, watchTowr had released a detection tool and had not published exploit code.

One condition applies to the whole chain. Barracuda says exploitation requires access to the appliance’s administrative interface (Admin UI). Devices whose admin interface can only be reached from an internal network are much harder to attack from outside.

Exploitation status and the KEV listing

When Barracuda’s advisory first appeared on November 2, 2026, the authentication field for CVE-2026-116606 still said administrative access was required. On November 5, Barracuda revised it to state that no authentication is required, provided the attacker can reach the admin interface. SecurityWeek had pointed out on November 4 that Barracuda’s advisory and Mandiant’s disclosure disagreed on this login requirement.

On November 9, Barracuda added an exploitation note to its advisory: “We have identified exploitation activity affecting a small number of organizations.” The company did not name the attackers, the number of victims, or the attack method, and the advisory lists no indicators of compromise.

On November 10, 2026, CISA added CVE-2026-116606 and CVE-2026-111560 to its Known Exploited Vulnerabilities (KEV) catalog, the list of flaws confirmed to be used in attacks. US federal agencies were given until November 13 to act, far shorter than the two-week deadline set for the other flaws added the same day. CISA also flagged both entries with the forensic triage requirement under directive BOD 26-04, so federal agencies must run a forensic review in addition to patching.

The ESG has been targeted before. In 2023, a different ESG flaw, CVE-2023-2868, had been exploited since October 2022, at least seven months before it was discovered, according to The Hacker News. That history is why checking for traces matters as much as installing the patch.

Affected products and available patches

Barracuda says patches have been released for every affected product. The ESG is exposed to both flaws. Five other products are affected only by the command injection: Load Balancer ADC, Message Archiver (BMA), WAF Control Center (WCC), Web Application Firewall (WAF), and Web Security Gateway (WSG).

For the ESG, the advisory lists patch BNSF-40425 for version 9.4.017 and later and BNSF-40430 for earlier versions. WAF and Load Balancer ADC use patch BNADC-16586, Message Archiver uses BNMA-32468, WAF Control Center uses BNWF-60060, and Web Security Gateway uses BNYF-24789.

Mandiant lists the versions affected by the command injection as ESG 9.4.0.27 and earlier, Load Balancer ADC 6.4.0 and earlier, WAF 11.0.1 and earlier, Web Security Gateway 16.1.100.100 and earlier, Message Archiver 5.5.4.0 and earlier, and WAF Control Center 2.2.1 and earlier. Barracuda advises customers to confirm that firmware is current and that all security patches are installed.

Appliances with automatic updates turned on can receive the patches on their own. The advisory asks customers to apply patches manually if they have not been installed, and to turn automatic patching back on if it was disabled. Devices that are several firmware versions behind may need more than one update.

What this means for university and corporate IT teams

Email gateways are usually deployed by organizations with many mailboxes, such as universities, hospitals, companies, and government offices. At a university, a single gateway can serve thousands of faculty, staff, and student accounts. An attacker who controls the device is in a position to see admission letters, payment notices, and password-reset links. Teams running a campus’s digital services can see the kinds of systems that usually connect to email on our education technology solutions page.

Check firmware versions and patch status

List every Barracuda appliance you manage, including devices at branch offices or other campuses. According to Barracuda, each device shows the latest firmware version available, so teams can compare it with the version running. Confirm that the patch matching the table above is recorded as installed.

Apply the patch today

If the patch did not arrive automatically, install it manually using the instructions on Barracuda Campus, the company’s official documentation site. For the ESG, make sure the version is 9.4.0.030 or later, since Mandiant says earlier versions are affected by the authorization bypass.

Keep the admin interface off the internet

Barracuda recommends making the admin interface reachable only from trusted internal networks, enforced through network access controls. This remains useful after patching. Test from outside your network, for example over a mobile connection, whether the appliance’s admin page still loads. If it does, restrict it with a firewall rule or VPN.

Look for traces before calling it safe

Because exploitation has already happened and Barracuda has not shared indicators of compromise, any appliance whose admin interface was exposed to the internet deserves a closer look. Review the configuration change history, unfamiliar backup restores, and changes to the timezone setting. If anything looks off, contact Barracuda support and treat the device as possibly compromised.

These steps mirror the response to the SonicWall SSL-VPN flaw last week: internet-facing security appliances are the first targets, so an up-to-date inventory of devices and versions pays off.

Frequently asked questions

Are Barracuda products other than the ESG affected?

Yes, by the command injection flaw CVE-2026-111560. Load Balancer ADC, Message Archiver, WAF Control Center, Web Application Firewall, and Web Security Gateway are affected, but an attacker still needs an administrator account. The authorization bypass, CVE-2026-116606, exists only in the ESG.

Is an appliance with a closed admin interface safe?

The risk is much lower. Barracuda says exploitation requires access to the admin interface, so devices that can only be managed from an internal network are harder to attack from outside. Patching is still necessary, because an attacker who is already inside the network can still reach it.

Do email users need to change their passwords?

Barracuda’s advisory does not recommend it. Password resets become relevant if the review finds signs that the appliance was compromised, since a gateway under an attacker’s control can be used to view mail passing through it.

Conclusion

The Barracuda ESG flaw chain is dangerous because it targets the very device meant to protect email. Installing the patches, keeping the admin interface off the internet, and reviewing configuration changes address most of the risk. If your team needs help building an inventory of security appliances and a patching routine, Merakit’s cybersecurity services team is ready to help.

Sources

• Barracuda, Pre-Authentication Authorization Bypass and Command Injection Vulnerabilities in Certain Barracuda Products (published November 2, 2026, updated November 9, 2026)
• CISA, Known Exploited Vulnerabilities Catalog (entries dated November 10, 2026)
• Mandiant, MNDT-2026-0042 (CVE-2026-116606) (November 2, 2026)
• Mandiant, MNDT-2026-0041 (CVE-2026-111560) (November 2, 2026)
• SecurityWeek, Barracuda Email Security Gateway Authentication Bypass Opens Path to Root (November 4, 2026)
• The Hacker News, report on watchTowr’s analysis of the Barracuda ESG flaw chain (November 6, 2026)
• The Hacker News, Alert: Hackers Exploit Barracuda Email Security Gateway 0-Day Flaw for 7 Months (May 31, 2023)