This is an explainer for two vulnerabilities in Barracuda Email Security Gateway (ESG, an appliance that screens incoming mail for spam and malware) and other Barracuda products, where an attacker who reaches the admin interface can take over the device. It covers scope and fixes from a defender's point of view and leaves out how to attack.
- CVE
- CVE-2026-116606 (authentication bypass) and CVE-2026-111560 (OS command injection)
- Severity
- 116606: CVSS v4.0 9.3 (Critical in the CVE record; Barracuda's advisory says High) / 111560: CVSS v4.0 8.6 (High)
- Type
- 116606: authentication bypass (CWE-288); a configuration-import function can be invoked without authentication to change the global configuration / 111560: OS command injection (CWE-78) in the timezone configuration field; commands run as root
- Preconditions
- 116606: no authentication needed, but the admin interface must be reachable (advisory corrected on 5 November) / 111560: administrator authentication required. The two can be chained
- Affected
- 116606: ESG / 111560: ESG, Load Balancer ADC, Message Archiver (BMA), WAF Control Center (WCC), Web Application Firewall (WAF), Web Security Gateway (WSG)
- Fix
- Given as patch IDs (ESG: BNSF-40425 / BNSF-40430). If not applied automatically, apply manually
- Published
- Barracuda advisory and CVE: 2 November 2026
- Exploitation
- Barracuda reports exploitation affecting a small number of organizations. Added to CISA KEV on 10 November 2026 (due 13 November). Forensic triage required
Risk of leaving it
In many deployments an ESG is placed where incoming mail passes, and it generally holds mail routing, forwarding settings and credentials for connected systems. Changing its global configuration, or taking root, reaches the content and flow of your mail. Barracuda says it has seen exploitation, and CISA assesses exploitation as active.
What kind of vulnerabilities these are
Barracuda covers both in a single advisory. It says exploitation requires access to the administrative interface of an affected product, and that combined, the flaws could let an attacker bypass authorization controls and obtain root on the device.
CVE-2026-116606 (ESG only)
- Type: authentication bypass (CWE-288)
- An unauthenticated attacker can invoke a configuration-import function and change the global configuration
- No authentication needed, but the admin interface must be reachable
- CVSS v4.0 9.3
CVE-2026-111560 (six products)
- Type: OS command injection (CWE-78)
- Insufficient checking of the timezone field lets an administrator run commands as root
- Administrator authentication required
- CVSS v4.0 8.6
One correction matters. On 5 November Barracuda changed the "Authentication Required" field for CVE-2026-116606 from Yes, administrative access to No (Administrative UI Access Required) (our translation, not a verbatim quote). No credentials are needed, so on a device whose admin interface is visible from outside, the precondition is already met. In this site's reading, CVE-2026-111560 needs an authenticated administrator, but combined with this bypass it also connects to an unauthenticated path (the KEV description also mentions the chain).
Barracuda does not describe the attack steps or the request format, and this site does not either.
Scope
| Product | CVE-2026-116606 | CVE-2026-111560 | Patch (Barracuda advisory) |
|---|---|---|---|
| Email Security Gateway (ESG) | Affected | Affected | BNSF-40425 (9.4.017 and later), BNSF-40430 (earlier than 9.4.017) |
| Load Balancer ADC | Not affected | Affected | BNADC-16586 |
| Message Archiver (BMA) | Not affected | Affected | BNMA-32468 |
| WAF Control Center (WCC) | Not affected | Affected | BNWF-60060 |
| Web Application Firewall (WAF) | Not affected | Affected | BNADC-16586 |
| Web Security Gateway (WSG) | Not affected | Affected | BNYF-24789 |
- The advisory gives fixes as patch IDs and does not list affected version ranges. The affected version ranges are given in the CVE records and the research firm's reports. CVE-2026-116606: ESG earlier than 9.4.0.030. CVE-2026-111560: ESG 9.4.0.27 or earlier, ADC 6.4.0 or earlier, WAF 11.0.1 or earlier, WSG 16.1.100.100 or earlier, BMA 5.5.4.0 or earlier, WCC 2.2.1 or earlier.
- Version formats differ between sources (for example 9.4.0.030 and 9.4.0.27), so decide using the latest firmware version the device displays and its patch status.
- Barracuda says a device several versions behind may need more than one update, and Barracuda Support can help.
- The only mitigation the advisory gives is limiting the admin interface to trusted internal networks. No setting replaces the update.
How to tell whether you are affected
Find every Barracuda device
Not only ESG: Load Balancer ADC, Message Archiver, WAF Control Center, Web Application Firewall and Web Security Gateway are affected too. Count physical, virtual and cloud instances separately (asset inventory checklist).
Check whether the admin interface is reachable from outside
Check whether the admin interface (Admin UI) is visible from the internet or from untrusted internal networks. Barracuda says organizations whose administrative interfaces are not publicly accessible are less exposed to this attack path.
Check firmware version and patch status
The device shows the latest available firmware version. Check whether the patch was applied automatically and that automatic patching has not been turned off.
What to do today
The KEV due date is 13 November. Work in this order.
Restrict the admin interface (first)
As Barracuda advises, limit the admin interface to trusted internal networks and restrict the sources that can reach it with access controls. You can do this without waiting for the update.
Preserve configuration and logs before updating
CISA's procedure says to collect evidence before patching, because patching can destroy artifacts. Save a copy of the device configuration and the administration, authentication and mail-processing logs elsewhere before updating, and record when and by whom they were collected (vulnerability response playbook).
Apply the patch and confirm it is applied
Apply the patch from the table above. If it was not applied automatically, apply it manually; if you had turned automatic patching off, set the device to receive patches automatically again. Manual instructions are on Barracuda Campus. Afterwards confirm the firmware version and patch status the device shows.
Check for signs of compromise (forensics)
Barracuda's advisory does not say how to check. The points below are this site's own addition.
- Added or changed administrator accounts, and admin interface logins from unexpected times or sources.
- Records of configuration changes and of configuration restores (imports), and any unexpected setting values.
- Unfamiliar changes to mail routing, forwarding or filter settings.
- Unusual outbound connections from the appliance, or unexpected administrative actions.
If anything looks suspicious, isolate the device and rotate credentials
If you find suspicious activity, isolate the device, bring in investigators and contact Barracuda Support. Treat the administrator passwords held on the device, credentials for connected systems (directory, mail servers, APIs) and certificates as needing replacement (this site's addition). Even if you find nothing, record what you checked and over what period.
Exploitation status
- Barracuda's advisory says it has identified exploitation affecting a small number of organizations (added 9 November).
- CISA added both to KEV on 10 November 2026 with a due date of 13 November (KEV version 2026.11.10), three days later.
- In KEV, forensic triage is Yes for both CVEs. Ransomware use is Unknown.
- The CVE records carry CISA's assessment: CVE-2026-116606 is actively exploited, automatable, total technical impact; CVE-2026-111560 is actively exploited, not automatable, total technical impact.
- NVD shows both as Undergoing Analysis, with the CVSS values assigned by the research firm.
- We could not confirm the scale, methods or actors from public information.
- Barracuda ESG has been in KEV before: CVE-2023-2868 was added on 26 May 2023. It is a different vulnerability.
This site's view: look at whether the admin interface is reachable, not whether authentication is required
Looking only at CVE-2026-111560, it is tempting to lower the priority because it needs administrator authentication. But CVE-2026-116606 can change the device's configuration without authentication, so together the condition becomes simply "the admin interface is reachable".
What defenders should look at is where the admin interface can be reached from, more than whether each flaw needs authentication. Limiting the admin interface to internal networks helps against these two and against the next flaw of this kind. Along with the update, make that restriction permanent (defending exposed devices).
Sources
- Barracuda — Pre-Authentication Authorization Bypass and Command Injection Vulnerabilities in Certain Barracuda Products (published 2 November, updated 5 and 9 November; affected products, patches, guidance, confirmed exploitation)
- Research firm reports — advisory for CVE-2026-116606 / advisory for CVE-2026-111560 (affected version ranges)
- CVE.org — CVE-2026-116606 / CVE-2026-111560 (published 2 November, includes CISA's additions)
- NVD — CVE-2026-116606 / CVE-2026-111560 (Undergoing Analysis)
- CISA KEV — CVE-2026-116606 / CVE-2026-111560 (added 10 November, due 13 November; the earlier ESG entry is in the same catalog)
- CISA — BOD 26-04 implementation guidance (forensic triage steps) (written for US federal agencies)
Last verified: 11 November 2026.
Read next
- Practice: Vulnerability response playbook / Asset inventory checklist
- Decision: Prioritising with CVSS, EPSS and KEV
- Exposed devices: How to defend VPN devices and remote access / Exploited edge device vulnerabilities, mid-October 2026
- Glossary: What is CVSS