Barracuda ESG Root Path (CVE-2026-116606 + CVE-2026-111560): Patch Email Gateways, WAF, ADC and Archivers Now

Status: Patches available from Barracuda as of 2 November 2026. Barracuda has not reported exploitation in the wild. As of our 3 November 2026 check, neither CVE appears in CISA's Known Exploited Vulnerabilities (KEV) catalog.

Executive Summary

On 2 November 2026, Barracuda Networks published an advisory titled "Pre-Authentication Authorization Bypass and Command Injection Vulnerabilities in Certain Barracuda Products — Updates Available" (Barracuda). It covers two flaws:

• CVE-2026-116606: a pre-authentication authorization bypass in the Email Security Gateway (ESG). An attacker can use it to change the appliance's global configuration.
• CVE-2026-111560: an OS command injection that lets someone with administrator rights run commands as root. It affects six Barracuda products: ESG, Load Balancer ADC, Message Archiver, WAF Control Center, Web Application Firewall and Web Security Gateway.

Barracuda's warning is that the two can be chained: "If exploited in combination, these vulnerabilities could allow an attacker to bypass authorization controls and obtain root access to the device." Barracuda has released patches for every affected product. It also says that "successful exploitation requires an attacker to have access to the administrative interface of an affected product." That makes an admin UI reachable from the internet the deciding exposure factor.

Barracuda lists CVSS scores of 9.3 for CVE-2026-116606 and 8.6 for CVE-2026-111560. Mandiant is the CVE Numbering Authority (CNA) for both records, and it publishes these scores as CVSS 4.0 vectors. A 9.3 falls in the CVSS 4.0 Critical band, and BleepingComputer calls CVE-2026-116606 a critical flaw (BleepingComputer). Barracuda's own advisory labels both CVE-2026-116606 and CVE-2026-111560 "Severity: High". We rate this advisory Critical because Barracuda itself calls CVE-2026-116606 a pre-authentication bypass, Mandiant's CNA record says it can be used by an unauthenticated remote attacker, and the chain ends in root on a security appliance.

This is a third-party risk problem because a Barracuda ESG sits in the mail path of the organizations that run it. It sees every inbound and outbound message, holds relay and routing configuration, and is trusted by downstream mail systems. A supplier or MSP running an unpatched ESG with an exposed admin interface holds a high-trust position that an attacker could take over.

What Happened

Vendor advisory (confirmed). Barracuda's advisory carries a published and updated date of 2 November 2026. It does not give a time of day. It says Barracuda "immediately initiated a comprehensive remediation process and released security patches for affected products." Customers should "review the affected products and remediation guidance," "ensure their systems are running the latest firmware version," and "have all security patches applied" (Barracuda).

CVE records (confirmed). Mandiant published both CVE records on 2 November 2026 at about 14:59 Asia/Jerusalem (12:59 UTC), along with Mandiant advisories MNDT-2026-0042 (CVE-2026-116606) and MNDT-2026-0041 (CVE-2026-111560). Mandiant's disclosure timelines say Barracuda reported the issues on 15 October 2026 (CVE-2026-111560) and 22 October 2026 (CVE-2026-116606). On 3 November, NVD listed both records as "Awaiting Analysis", so NVD has not yet added its own (Primary) score (NVD CVE-2026-116606, NVD CVE-2026-111560).

Press coverage (reported). BleepingComputer reported the advisory on 3 November 2026 at about 17:06 Asia/Jerusalem. It reproduced Barracuda's patch table and its admin-access guidance (BleepingComputer).

Exploitation status. Barracuda has not reported exploitation of either CVE. Neither CVE is in CISA KEV (catalog version 2026.10.30, checked 3 November 2026). CISA's SSVC entries on the NVD records, dated 2 November 2026, show "Exploitation: none" for both. They also mark CVE-2026-116606 as "Automatable: yes" and both CVEs as "Technical impact: total". We will update this post if Barracuda, CISA or another primary source reports exploitation.

Historical Context: Barracuda ESG and UNC4841 (Reported Background Only)

Barracuda ESG has been targeted before. In 2023, a group that Mandiant tracks as UNC4841 exploited the ESG zero-day CVE-2023-2868 in a cyber-espionage campaign. Barracuda later said exploitation began at least as early as October 2022 (BleepingComputer). CVE-2023-2868 is in CISA KEV. BleepingComputer also notes that UNC4841 used a later ESG flaw, CVE-2023-7102, in zero-day attacks. We covered the 2023 campaign in our CVE-2023-2868 advisory.

This is background, not a link. Nothing public connects CVE-2026-116606 or CVE-2026-111560 to UNC4841 or any other actor, and nobody has reported exploitation of either. We mention 2023 for one reason: ESG appliances have already been a target for capable attackers, so a fast patch cycle on this product family is worth the effort.

Technical Information

This section is limited to what Barracuda and the CNA have published. We have not run, reproduced or reverse-engineered any exploit.

CVE-2026-116606: pre-authentication authorization bypass (ESG only)

• Vendor description: Barracuda calls it a "Pre-Authentication Authorization Bypass" in ESG.
• CNA description: "An authentication bypass in Barracuda Email Security Gateway versions earlier than 9.4.0.030 allows an unauthenticated remote attacker to invoke a configuration-import function and restore a crafted, compatible backup archive, resulting in unauthorized modification of the appliance's global configuration" (MNDT-2026-0042).
• Weakness: CWE-288 (Authentication Bypass Using an Alternate Path or Channel).
• Score: CVSS 9.3, published by Barracuda (no CVSS version stated) and by Mandiant as CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N.
• Impact: An attacker can overwrite the appliance's global configuration. On an email gateway, that configuration includes mail routing, policy and administrative settings.

CVE-2026-111560: OS command injection as root (six products)

• Vendor description: Barracuda calls it a "Command Injection" affecting ESG, ADC, BMA, WCC, WAF and WSG.
• CNA description: improper neutralization of shell metacharacters in the timezone configuration field, in code shared across several Barracuda appliance products. An authenticated administrator can inject OS commands that run with root privileges (MNDT-2026-0041).
• Weakness: CWE-78 (OS Command Injection).
• Score: CVSS 8.6, published by Barracuda and by Mandiant as CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N.
• Impact: Code execution as root on the appliance for anyone who has, or can obtain, administrator rights.

The combined path. Barracuda states that, used together, the two flaws let an attacker "bypass authorization controls and obtain root access to the device." The full chain applies only to ESG, the one product affected by both CVEs. On the other five products, CVE-2026-111560 still gives root to anyone who already holds admin credentials. That matters if those credentials are weak, shared or reused.

Precondition. Barracuda's advisory lists "Authentication Required: Yes, administrative access" for both CVEs. It also says that "successful exploitation requires an attacker to have access to the administrative interface." Mandiant describes CVE-2026-116606 as reachable by an unauthenticated remote attacker. The two sources do not agree on credentials: Barracuda's table says administrative access is required, while Mandiant's record says the ESG bypass does not need it. Both agree the attacker must be able to reach the administrative interface. Until Barracuda clarifies, treat any ESG admin interface reachable from untrusted networks as exposed. Barracuda adds that organizations whose admin interfaces "are not publicly accessible from the internet are less exposed to this attack path."

Affected Product Versions

The table below is Barracuda's own product and patch table (Barracuda):

The CNA records give the following affected version ranges (MNDT-2026-0042, MNDT-2026-0041):

• CVE-2026-116606: ESG earlier than 9.4.0.030.
• CVE-2026-111560: ESG ≤ 9.4.0.27; ADC ≤ 6.4.0; WAF ≤ 11.0.1; WSG ≤ 16.1.100.100; BMA ≤ 5.5.4.0; WCC ≤ 2.2.1.

Barracuda's "9.4.017" is the cut-off for choosing which of the two ESG patches to install. The CNA version strings use a different format. When a source does not state a fixed build, check it on the device or with Barracuda Support rather than inferring it from version numbers. Barracuda notes that "the device will show the latest firmware version available."

Barracuda has not published an exact time of day for patch release. The advisory says patches were released and that some devices may have received them automatically.

Workaround and Mitigation

Barracuda's guidance (Barracuda):

1. Apply the patches now. "If a patch has not been automatically applied, customers should manually apply the appropriate patch as soon as possible." On ESG, pick BNSF-40425 or BNSF-40430 based on the current firmware.
2. Re-enable automatic patching if it was turned off. Barracuda recommends "setting devices to automatically receive patches."
3. Bring firmware fully up to date. "If firmware on a device is multiple versions out of date, customers may need to perform more than one update." Barracuda's Campus documentation and Barracuda Support cover the manual steps.
4. Restrict administrative interfaces. Barracuda recommends "restricting access to administrative interfaces to trusted internal networks and using appropriate network access controls to limit exposure."

Further hardening steps for defenders. These are our recommendations, not Barracuda's:

• Find exposed admin UIs. Check external attack-surface data for ESG, WAF, ADC, BMA, WCC and WSG management interfaces that answer from the internet. Close them, or put them behind a VPN or an IP allowlist.
• Review admin accounts. CVE-2026-111560 gives root to any administrator, so rotate shared or default admin credentials, remove unused accounts, and enforce strong authentication wherever the product supports it.
• Check configuration integrity on ESG. CVE-2026-116606 lets an attacker change the global configuration. Compare the current ESG configuration with a known-good backup, looking especially at mail routing, relay, policy and admin settings. Record any change nobody can explain.
• Keep logs. Before patching, export admin and system logs if you can, so there is a record if questions come up later.
• Treat managed appliances like your own. If an MSP runs the appliance for you, get written confirmation of the patch level and of who can reach the admin interface.

Indicators of Compromise

None published. Barracuda's advisory and both Mandiant disclosures contain no indicators of compromise: no hashes, IPs, domains, file paths or log signatures. That fits with no reported exploitation. We have not created our own IoCs.

What defenders can usefully look for, based only on the published descriptions:

• Changes to the ESG global configuration that no administrator made, or a configuration import or restore no one remembers running.
• Changes to timezone or other system settings on any affected product that don't line up with admin activity.
• Admin-interface sessions from unexpected source addresses.

None of these is a confirmed sign of exploitation. They are starting points for checking.

TPRM: What to Do With Barracuda-Dependent Vendors Today

An ESG is a high-trust part of a supplier's mail flow, so a compromise there can reach your organization through that supplier. Barracuda WAF, ADC and WSG units often sit at the network edge in front of customer-facing applications. Send short, specific questions to your critical vendors and MSPs today:

1. Do you run any of these Barracuda products: Email Security Gateway, Web Application Firewall, Load Balancer ADC, Message Archiver, WAF Control Center or Web Security Gateway? Include appliances you operate for customers as an MSP.
2. Is any admin interface reachable from the internet? If so, when will access be restricted to trusted internal networks?
3. What is your patch status? Have BNSF-40425/40430, BNADC-16586, BNMA-32468, BNWF-60060 and BNYF-24789 been applied where relevant? If not, what is the planned date? Is automatic patching on?
4. For ESG operators: have you checked the global configuration for unexplained changes since before 2 November 2026?
5. Will you tell us if Barracuda or another authority reports exploitation of these CVEs, and if you find anything in your own review?

Prioritize vendors whose email passes through a Barracuda ESG, and vendors that expose Barracuda WAF or ADC in front of systems that hold your data. Treat answers as claims to check: compare reported patch dates and admin-UI exposure against external signal before closing the item. Our platform validates vendor claims against live attack-surface signal and chases findings to closure under your approval.

Need help working through Barracuda ESG / WAF / ADC suppliers still on unpatched builds? Our team can help you prioritize them and track their answers. Talk to an expert

Sources

• Barracuda: Pre-Authentication Authorization Bypass and Command Injection Vulnerabilities in Certain Barracuda Products — Updates Available (2 Nov 2026)
• Mandiant: MNDT-2026-0042 (CVE-2026-116606)
• Mandiant: MNDT-2026-0041 (CVE-2026-111560)
• NVD: CVE-2026-116606 and CVE-2026-111560
• BleepingComputer: Barracuda warns of critical flaws allowing root access to devices (3 Nov 2026)
• KEV status, checked 3 Nov 2026: CVE-2026-116606 and CVE-2026-111560 are not in CISA's Known Exploited Vulnerabilities Catalog (catalog version 2026.10.30).