CVE-2026-116606: Barracuda ESG Authentication Bypass Is Being Exploited - Update and Check for Compromise

On November 2, 2026, Barracuda published an advisory on two vulnerabilities in Barracuda Email Security Gateway (ESG) and provided patches the same day. CVE-2026-116606 is an authentication bypass with a CVSS 4.0 score of 9.3: an attacker without logging in can invoke a configuration import function through the management interface, import a crafted backup, and thereby modify the appliance’s global configuration. According to NVD and Mandiant, all ESG versions before 9.4.0.030 are affected. Combined with command injection CVE-2026-111560, root access to the device is possible, according to Barracuda. On November 9, 2026, Barracuda added a note to the advisory stating that the vulnerabilities had been exploited at a small number of organizations. The US agency CISA added both CVEs to its Known Exploited Vulnerabilities (KEV) Catalog on November 10, 2026.

Key points at a glance

Affected versions and updates

Barracuda identifies the fixes in its advisory by patch IDs; the 9.4.0.030 version threshold comes from Mandiant’s CVE entry and NVD. The notation “9.4.017” follows the advisory. If the firmware is several versions behind, more than one update may be required before the patch takes effect, according to Barracuda.

CVE-2026-111560 (command injection, CVSS 4.0: 8.6) affects additional products besides ESG. Without CVE-2026-116606, exploitation there requires administrator privileges. The version thresholds come from Beazley Security’s overview, while the patch IDs come from the Barracuda advisory:

What is known about exploitation

In its update of November 9, 2026, Barracuda wrote that it had identified exploitation at a small number of organizations. Barracuda provides no details on the number of affected organizations, the attackers, or their methods; the advisory contains no indicators (IoCs). CISA has listed CVE-2026-116606 and CVE-2026-111560 in its KEV Catalog since November 10, 2026, and requires US federal agencies to implement the vendor’s measures and conduct a forensic review under BOD 26-04 by November 13, 2026. If remediation is not possible, CISA says the product should be taken out of service.

Barracuda reported the vulnerability on October 22, 2026; Mandiant published the CVE entry and advisory MNDT-2026-0042 on November 2, 2026. According to Mandiant, the attack proceeds through configuration import: a crafted, compatible backup is imported without logging in and overwrites the global configuration. According to SecurityWeek, CVE-2026-111560 is located in the time zone setting and allows commands to be run with root privileges.

According to SecurityOnline, watchTowr Labs published a technical analysis and a script for the chain on GitHub. The repository is public; watchTowr describes the script as a “Detection Artifact Generator,” while SecurityOnline says it accepts arbitrary commands. SecurityOnline describes the causes as follows: a failed password change reports an error but does not stop processing; the checksum of backup files is based on a hard-coded secret, allowing valid backups to be forged; a time zone value in the backup then executes the injected command as root. It is not known whether the observed attacks use this script.

Immediate actions

1. Check patch status: In the web interface, go to ADVANCED > Firmware Update and, in the “Firmware Patches” section, click “Sync Now” to retrieve available patches and verify whether BNSF-40425 or BNSF-40430 has been applied. According to Barracuda, the patches may have been installed automatically.

2. Install the patch or firmware update: If the patch is missing, install it manually immediately. In “Automatic” mode, the appliance does not restart itself after a patch, according to Barracuda documentation; if a restart is required, initiate it manually. For older firmware, first perform the necessary update steps.

3. Enable automatic patching: If “Apply Patches” is set to “Disable” (the default according to the documentation) or “Manual,” Barracuda recommends enabling automatic application again.

4. Isolate the management interface: Restrict access to the management interface to trusted internal networks, such as a management network or a VPN, and enforce this on the upstream firewall. Barracuda considers devices whose management interface is not reachable from the internet to be less at risk. This measure does not replace the patch.

5. Check other Barracuda products: Check Load Balancer ADC, WAF, WSG, Message Archiver, and WAF Control Center for patches for CVE-2026-111560.

Checking for compromise

Barracuda and CISA have not published any indicators. Since the vulnerability is being exploited and can be accessed without logging in, every device should be checked whose management interface was reachable from outside the management network before patching. Field Effect recommends the following:

1. Determine reachability: Determine whether, and since when, the management interface was reachable from the internet or networks outside the administrative environment; preserve firewall and proxy logs for that period.

2. Review administrative access: Review access to the management interface from unknown addresses.

3. Look for configuration imports: Restores of configuration backups that did not originate from your own administration are an indicator of CVE-2026-116606.

4. Review configuration changes: Check configuration changes for unexpected entries. Comparing against a known clean backup is helpful; this also includes the time zone setting through which CVE-2026-111560 is triggered.

5. Change credentials: If compromise is suspected, change all credentials, keys, and accounts reachable from the appliance.

According to the CVE description, a successful attack modifies the global configuration; in combination with CVE-2026-111560, root access is possible. The sources do not state whether the patch reverses such changes. Therefore, continue checking after the update and preserve logs and configuration before making changes so forensic analysis remains possible. Following the campaign involving CVE-2023-2868, Barracuda required the replacement of compromised devices, according to SecurityWeek; no such recommendation has been issued for the current vulnerabilities so far (as of November 11, 2026).

Context

CVE-2026-116606 affects only operators of Barracuda Email Security Gateway; CVE-2026-111560 additionally affects five other Barracuda products. ESG has been targeted in attacks before: according to BleepingComputer, CVE-2023-2868 had been exploited by the UNC4841 group since at least October 2022, and according to Mandiant (cited by BleepingComputer), nearly one-third of compromised devices at the time belonged to government agencies. No reports from NCSC Switzerland, BSI, or CERT-FR on CVE-2026-116606 could be found as of November 11, 2026.