Barracuda ESG flaws exploited for root: patch, lock the Admin UI

If a Barracuda Email Security Gateway filters your mail, check it today. Barracuda now says attackers are exploiting two Barracuda ESG flaws, CVE-2026-116606 and CVE-2026-111560. Chained, they give root on the appliance. CISA added both to its Known Exploited Vulnerabilities catalog on November 10 and gave federal agencies until November 13 to fix them. That is a three-day window. CISA does not usually move that fast.

What actually happened

Barracuda published the advisory on November 2 with patches. On the evening of November 9 it added that it had seen exploitation "affecting a small number of organizations." It names no attacker.

• CVE-2026-116606 (CVSS 9.3, ESG only). A pre-authentication authorization bypass. Per CISA's KEV entry, an unauthenticated attacker can use the configuration-import function to restore a crafted backup and change the appliance's global configuration. Barracuda's one condition: the attacker must be able to reach the administrative interface (Admin UI).
• CVE-2026-111560 (CVSS 8.6). OS command injection through a crafted timezone value. It runs commands as root. Alone, it needs admin access. It also affects Barracuda Load Balancer ADC, Message Archiver, WAF, WAF Control Center and Web Security Gateway.
• The chain. The first bug gets past authorization and the second turns that into root.
• Patches. On ESG, apply BNSF-40425 for firmware 9.4.017 and above, or BNSF-40430 below that. The other products have their own patch IDs in the advisory. Barracuda says firmware that is several versions behind can need more than one update.

Some early coverage said the command injection bug needs no login. Barracuda's advisory and CISA both say it needs an authenticated admin. We go with them. The bypass is what removes the need for a login. BleepingComputer reported the exploitation first.

Why it matters for your business

Every invoice and password reset link goes through your email gateway. Root on that box gives an attacker your mail and a foothold in your network. In 2023, attackers who got in through an earlier ESG zero-day stayed for months.

Do this today:

1. Confirm the patch is on. Barracuda pushes patches automatically, but this one may not have reached you. Barracuda's words: "If a patch has not been automatically applied, customers should manually apply the appropriate patch as soon as possible." If you turned auto-patching off, turn it back on.
2. Close the Admin UI to the internet. Barracuda says appliances without an internet-facing admin interface "are less exposed." Allow access only from trusted internal networks or a VPN.
3. Look for tampering. CISA flags both CVEs as needing forensic triage for federal agencies. Patching stops new attacks, but it does not undo a change that is already there. Look for configuration changes and admin logins you can't explain since November 2.

Sources: Barracuda security advisory, CISA KEV alert, November 10, BleepingComputer.