Menu
Breach Value Calculator

Barracuda ESG CVE-2026-116606: Patch and Lock Down the Admin UI

Barracuda ESG flaws CVE-2026-116606 and CVE-2026-111560 are exploited. Affected products, patch IDs, admin UI exposure and compromise checks.

By CyphrQ.ai

Written with AI assistance and human editorial review. Every figure linked to its source.

Published 10 min read

AI-generated illustration: Barracuda ESG CVE-2026-116606: Patch and Lock Down the Admin UI
AI-generated illustration

Barracuda says two chained flaws in its Email Security Gateway (ESG), CVE-2026-116606 and CVE-2026-111560, are exploited against "a small number of organizations". Together they can give an outsider full control of the appliance, if the admin interface is reachable. CISA's due date for US federal agencies is 13 November 2026. Patch, take the admin interface off the internet, then check for compromise.

Sources checked 11 November 2026.

Barracuda Email Security Gateway is an appliance that filters an organisation's email before it reaches the mail server. Like a VPN gateway or firewall, it sits at the edge of the network and faces the internet by design.

This post covers what the two flaws are, which Barracuda products need a patch, and what to do this week. For why edge devices draw so much attacker attention, see why edge devices get exploited.

What are Barracuda CVE-2026-116606 and CVE-2026-111560?

One flaw opens the door and the other hands over the device, so the risk comes from the pair. Barracuda's advisory, published 2 November 2026, puts it this way: "If exploited in combination, these vulnerabilities could allow an attacker to bypass authorization controls and obtain root access to the device." Root is the account with full control of the appliance.

CVE What it is Needs a login? Severity Products
CVE-2026-116606 Pre-authentication authorization bypass (CWE-288) No, but the admin interface must be reachable CVSS 4.0 9.3 ESG only
CVE-2026-111560 OS command injection that runs as root (CWE-78) Yes: administrative access CVSS 4.0 8.6 ESG, Load Balancer ADC, Message Archiver, WAF, WAF Control Center, Web Security Gateway

Sources: Barracuda's advisory for the products and scores, and Mandiant's disclosures MNDT-2026-0042 (CVE-2026-116606) and MNDT-2026-0041 (CVE-2026-111560) for the CVSS 4.0 vectors and CWE numbers. The CVSS figure rates severity from 0 to 10, and the CWE label says what kind of mistake caused the flaw. Barracuda labels both flaws "High", including the 9.3.

On its own, the command injection needs an administrator login. The bypass is what removes that requirement. That is why the pair matters more than either score suggests.

The advisory changed after publication. On 5 November 2026 Barracuda changed the "Authentication Required" field for CVE-2026-116606 to "No (Administrative UI Access Required)". In plain terms: no password is needed, but the attacker has to be able to reach the admin interface over the network.

Is the Barracuda ESG flaw being exploited?

Yes. On 9 November 2026 Barracuda updated its advisory with exploitation activity it has observed "affecting a small number of organizations".

No attacker has been named. Barracuda's advisory, Mandiant's disclosures and CISA's KEV entries identify no threat actor, as read on 11 November 2026.

How do I know if my Barracuda appliance is affected?

Check three things.

  1. Which Barracuda products do you run? CVE-2026-116606 affects only ESG. CVE-2026-111560 affects all six products in the table below, so a WAF or Message Archiver still needs its patch even though it isn't exposed to the bypass.
  2. Which firmware does it run? Mandiant lists the affected versions (below). Barracuda says: "The device will show the latest firmware version available."
  3. Is the admin interface reachable from the internet? Barracuda says organisations whose administrative interfaces "are not publicly accessible from the internet are less exposed". Less exposed is not the same as safe: anyone on the internal network can still reach it.

Which patch does each Barracuda product need?

Product CVE-2026-116606 CVE-2026-111560 Barracuda patch Affected versions (Mandiant)
Email Security Gateway (ESG) Yes Yes BNSF-40425 (9.4.017+), BNSF-40430 (<9.4.017) Earlier than 9.4.0.030 (CVE-2026-116606); 9.4.0.27 and earlier (CVE-2026-111560)
Load Balancer ADC No Yes BNADC-16586 6.4.0 and earlier
Message Archiver (BMA) No Yes BNMA-32468 5.5.4.0 and earlier
WAF Control Center (WCC) No Yes BNWF-60060 2.2.1 and earlier
Web Application Firewall (WAF) No Yes BNADC-16586 11.0.1 and earlier
Web Security Gateway (WSG) No Yes BNYF-24789 16.1.100.100 and earlier

Sources: patch IDs from Barracuda's advisory as written there, read 11 November 2026; version ranges from Mandiant's MNDT-2026-0041 and MNDT-2026-0042. Barracuda and Mandiant write ESG version numbers differently, so confirm with Barracuda Support which ESG patch applies to your firmware rather than matching the numbers by eye.

What should Barracuda owners do this week?

Patch, close the exposure, then look for signs that someone got in first.

  1. Check the firmware. Barracuda says to confirm the device runs the latest firmware and has all security patches.
  2. Apply the patch for each product from the table above, internet-facing ESG appliances first. If a patch wasn't applied automatically, Barracuda says to apply it manually as soon as possible.
  3. Expect more than one update on older appliances. Barracuda says devices several firmware versions behind may need more than one update. Barracuda Support can help.
  4. Turn on automatic patching. Barracuda recommends setting devices to receive patches automatically.
  5. Take the admin interface off the internet. Barracuda recommends restricting admin access to trusted internal networks and using network access controls. The mail-filtering service has to face the internet; the admin console does not.
  6. Check for compromise (next section), and keep a written record of each appliance, its firmware before and after, and what you checked.

If you want a standing playbook for fixes like this one, read time to exploit and emergency patching.

How can I tell if my Barracuda ESG was compromised?

Barracuda's advisory, as read on 11 November 2026, lists no indicators of compromise. Neither do Mandiant's two disclosures. So the checks below come from two places, and each is labelled.

From how the flaws work (our inference from the Mandiant and CISA descriptions, not a vendor checklist):

  • Unexpected configuration changes or restored backups. CISA says CVE-2026-116606 lets an outsider "restore a crafted, compatible backup archive", and Mandiant says this results in "unauthorized modification of the appliance's global configuration." A configuration import or restore that nobody on your team ran is the first thing to look for.
  • An odd timezone setting. CISA says CVE-2026-111560 runs injected commands "when the crafted timezone value is subsequently processed". A timezone field that holds anything other than a timezone deserves a closer look.

General good practice (not from Barracuda, Mandiant or CISA):

  • New or changed admin accounts, and admin logins from addresses you don't recognise.
  • Logs kept off the box. Copies already sent to a SIEM (a central log and alerting system) or syslog server are the ones to trust, because an attacker with root can edit logs on the appliance itself.

If you find something, bring in incident response help before rebuilding. An email gateway sees your mail flow, so ask your responder what the appliance stored or could reach.

What are CISA's deadlines for the Barracuda flaws?

CISA added both CVEs to its Known Exploited Vulnerabilities (KEV) catalogue on 10 November 2026 with a due date of 13 November 2026, three days later. KEV lists flaws CISA has evidence attackers are using.

Under Binding Operational Directive (BOD) 26-04, that date is binding only for US federal civilian agencies. Outside US government, treat it as a strong hint about how fast to act. CISA's entry for CVE-2026-116606 notes that it "can be chained with CVE-2026-111560".

Both entries mark forensic triage as required, which means agencies must check whether the device was compromised, not just patch it. CISA lists ransomware use as "Unknown" on both entries.

Our guide to reading the KEV list next to severity and likelihood scores is CVE, CVSS, EPSS and KEV explained.

Going deeper: for security and IT teams

Identifiers and scoring. CVE-2026-116606: Mandiant disclosure MNDT-2026-0042, CWE-288 (Authentication Bypass Using an Alternate Path or Channel), CAPEC-115, CVSS 4.0 9.3, CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. CVE-2026-111560: MNDT-2026-0041, CWE-78 (OS Command Injection), CAPEC-88, CVSS 4.0 8.6, CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. The only vector difference is PR:N against PR:H. Mandiant's timelines record the reports on 22 October 2026 (CVE-2026-116606) and 15 October 2026 (CVE-2026-111560), with both CVEs and disclosures published on 2 November 2026.

Score the chain, not the link. PR:H holds the command injection to 8.6 because it assumes an attacker who already has an admin session. CVE-2026-116606 supplies a way past authentication on ESG, so on an ESG with a reachable admin interface the practical precondition is network reach, not credentials. On the five other products, which the bypass doesn't affect, the 8.6 precondition stands: the attacker needs admin credentials, from phishing, reuse or a weak password.

Mechanism, at the level the sources describe it. CISA's KEV entry says the bypass lets an unauthenticated remote attacker "invoke a configuration-import function and restore a crafted, compatible backup archive". Mandiant describes the injection as improper neutralisation of shell metacharacters in the timezone configuration field, in code common to the six affected products. A configuration restore is a privileged action that rewrites the appliance's settings, so treat the backup and restore path as part of the attack surface. This post goes no further into mechanics than that.

Threat model. The attacker needs network reach to the ESG admin interface. They get global configuration changes from the bypass and, chained with the injection, root on the appliance. None of the sources describes what the attackers did once inside, so this post doesn't speculate.

In practice: a three-day deadline with triage attached. The KEV entries give both CVEs the same 10 November listing and 13 November due date, and mark forensic triage as required. CISA's BOD 26-04 implementation guidance sets the sequence agencies follow: scope, preserve and collect evidence, patch, contain, triage, then decide on escalation. It says "Collect all required evidence prior to this step as patching may jeopardize the availability of artifacts", and "Premature containment can destroy vital evidence." CISA also says "The requirement of BOD 26-04 is that an adequate forensic triage analysis is performed; the specific timeline below is not required." Outside government, weigh evidence capture against patch delay with your incident responder; on an internet-reachable admin interface, cutting that exposure first is the quickest risk reduction.

In practice: the same pattern as Ivanti in October. The Ivanti Connect Secure flaws exploited in October 2026 also chained a login bypass with a privilege escalation on an edge appliance. Two vendors, the same lesson: when a chain starts with a bypass, the post-authentication score underrates the risk.

Detection and evidence to collect. No vendor indicators exist yet, so collect what tells you whether the chain was used: - Configuration import, restore and backup events, with who, when and from which source address. - The current timezone setting, compared with a configuration export or backup you can verify was taken before any suspicious activity. A backup from before 2 November 2026 is not automatically known-good: none of the sources gives a start date for exploitation. If you can't verify a backup, ask Barracuda Support about rebuilding the appliance. - Admin account list and admin session history, compared with your change records. - Admin interface access logs and firewall logs in front of the appliance: which source addresses reached the admin port, and when. - Off-box syslog compared with what the appliance still holds; gaps are a finding.

Controls with specifics. Allow the admin interface only from a management network or jump host, enforced by a firewall rule in front of the appliance, not only by an appliance setting. Turn on automatic patching, as Barracuda recommends. Stream logs off the device. Review WAF, ADC, Message Archiver, WCC and WSG estates for CVE-2026-111560 even if you run no ESG.

Questions for your MSP or Barracuda. - Which Barracuda appliances do we run, on which firmware, and is each one patched with the ID in Barracuda's table? - Was any admin interface reachable from the internet before 2 November 2026, and is it today? - Is automatic patching on for every appliance? - Are the gateway's logs copied somewhere the attacker can't reach, and how many weeks do you keep? - Has anyone checked for configuration restores, timezone changes and new admin accounts since the advisory?

Key takeaways

  • Barracuda says CVE-2026-116606 and CVE-2026-111560, chained, can give an attacker root on ESG, and that exploitation has affected "a small number of organizations".
  • CVE-2026-116606 needs no login but does need a reachable admin interface; CVE-2026-111560 also affects ADC, BMA, WAF, WCC and WSG.
  • Apply Barracuda's patch for each product, turn on automatic patching, and expect more than one update on older firmware.
  • Restrict the admin interface to trusted internal networks, as Barracuda recommends.
  • CISA's KEV due date is 13 November 2026 for US federal agencies, with forensic triage required: patching alone doesn't close the case.

Sources

Spotted a mistake? Report a correction.