Barracuda has confirmed attacks on the CVE-2026-116606 flaw in its Email Security Gateway (ESG). In an update to its security advisory, the vendor says it has observed exploitation activity affecting “a small number of organizations”. The update is dated November 9, 9:00 p.m. Eastern Time – 3:00 a.m. on November 10 in Central Europe. Patches have been available since November 2. Anyone running an ESG with a reachable admin interface who has not updated yet should do so now.
Update Nov 11, 2026: CISA added CVE-2026-116606 and CVE-2026-111560 to its Known Exploited Vulnerabilities catalog on November 10, 2026. The federal remediation deadline is November 13, 2026.
CVE-2026-116606: what exactly is affected
According to Barracuda’s security advisory, two vulnerabilities are involved, and they can be chained:
- CVE-2026-116606 is a pre-authentication authorization bypass. It affects the Email Security Gateway only. CVSS score: 9.3.
- CVE-2026-111560 is a command injection. It requires administrator privileges but sits in shared code and affects not only the ESG but also Load Balancer ADC, Message Archiver (BMA), WAF Control Center (WCC), Web Application Firewall (WAF) and Web Security Gateway (WSG). CVSS score: 8.6.
Barracuda rates both flaws “High” in severity, even though 9.3 falls into the critical range on the CVSS 4.0 scale. The CVE records come from Mandiant, which published both flaws as the CNA. The Mandiant advisory MNDT-2026-0042 describes CVE-2026-116606 as follows: an unauthenticated attacker can invoke a configuration-import function and restore a crafted, compatible backup archive, modifying the appliance’s global configuration. According to Mandiant, ESG versions earlier than 9.4.0.030 are affected.
Combined, the two flaws give an attacker root access to the device, Barracuda says. The prerequisite is that the attacker can reach the administrative interface.
A quiet correction on November 5
The advisory has received two updates since it was first published. The first, on November 5, is easy to miss but important: for CVE-2026-116606, Barracuda changed the “Authentication Required” field from “Yes, administrative access” to “No (Administrative UI Access Required)”. No login is needed – being able to reach the admin interface over the network is enough. The second update, on November 9, adds the observed exploitation.
The Canadian Centre for Cyber Security also updated its alert AV26-1112 on November 9, citing open-source reporting that CVE-2026-116606 is being exploited in the wild. In the US agency CISA’s Known Exploited Vulnerabilities catalog, the flaw was not yet listed in the November 9 version (as of 7:54 p.m. UTC).
How the attack chain works
Security firm watchTowr dissected the patches in a detailed analysis on November 5. Its write-up explains why the combination is so dangerous:
- A failed password change opens the door: when a password change fails, the vulnerable code does not stop the request. It returns the current session’s role instead – for an unauthenticated attacker, the low-privilege login-screen role. Processing then simply continues.
- Backup upload without a login: through this path, the researchers reached an upload handler that restores an uploaded file as a configuration backup.
- A checksum with a fixed secret: Barracuda does protect backups with a checksum. But according to watchTowr, the secret used to compute it is hard-coded, so valid checksums can be calculated by anyone.
- The time zone as a shell command: the restored data includes the system time zone value. That value ended up unchecked in a shell call. A script that processes the value further runs via
sudo– so the injected command executes with root privileges.
According to watchTowr, the patch replaces the shell calls with plain Perl reads and writes and only accepts time zones that exist as a file under /usr/share/zoneinfo/. watchTowr has released a detection artefact generator that operators can use to check whether their appliance is vulnerable.
Comparing version numbers reveals some discrepancies: watchTowr compared ESG 9.4.0.027 (vulnerable) with 9.4.0.029 and lists 9.4.0.029 as the fixed version. Mandiant and the Cyber Centre list versions “earlier than 9.4.0.030” as affected. For the command injection CVE-2026-111560, Mandiant lists some products as affected “up to and including” the version number that the Cyber Centre gives as “prior to”. What ultimately counts is Barracuda’s patch table.
What ESG operators should do now
Barracuda lists a separate patch identifier for each product:
- Email Security Gateway: BNSF-40425 (for firmware 9.4.017 and later) or BNSF-40430 (for older firmware)
- Load Balancer ADC and Web Application Firewall: BNADC-16586
- Message Archiver: BNMA-32468
- WAF Control Center: BNWF-60060
- Web Security Gateway: BNYF-24789
The vendor’s recommendations at a glance:
- Check the firmware: the device shows the latest available version. If the firmware is several versions behind, multiple consecutive updates may be needed.
- Apply the patch manually if it was not installed automatically.
- Turn automatic patching back on if it has been disabled.
- Lock down the admin interface: allow access only from trusted internal networks. Appliances without a publicly reachable admin interface are less exposed, Barracuda says.
Also sensible, though not part of the vendor’s guidance: anyone whose admin interface was reachable from the internet in recent weeks should review configuration and logs for unexpected changes – especially unknown backup restores and an unusual time zone setting. Barracuda has not published a list of indicators of compromise in the sources we reviewed.
Analysis: edge devices remain the favourite target
The ESG is no stranger to trouble for Barracuda. In 2023, the appliance was attacked via the zero-day CVE-2023-2868, and Barracuda even advised affected customers to replace the hardware. The current case is different – patches are available – but it shows the same underlying problem: devices at the network edge process everything, run with far-reaching privileges and are often monitored less closely than servers.
The pattern has come up several times in recent days. We recently covered the SonicWall flaw CVE-2026-19868 that bypasses SAML MFA and the SSHole flaw in OpenSSH on musl systems. And as with the file upload flaw CVE-2026-114432 in Contact Form 7, the real danger only emerges when several individual bugs are combined.
It is currently unclear who is behind the attacks, how many devices are affected, and whether the full chain or only the authorization bypass was used. Barracuda only speaks of a “small number” of affected organizations. Once details emerge, the question of how long the flaw was known before the patch may also be answered. Until then, the simple rule applies: patch, take the admin interface off the internet, check the logs.
