Barracuda ESG Root Access Flaws Exploited
Two Barracuda ESG root access flaws that work together on the appliance are being exploited, per Barracuda’s own update. Barracuda patched them in early November and said on November 9 that it had seen attacks on a small number of organizations. CISA added both to its Known Exploited Vulnerabilities list on November 10 and gave US federal agencies until November 13 to fix them.
What Happened With the Barracuda ESG Root Access Flaws
CVE-2026-116606 (CVSS 9.3) is an authentication bypass in the Email Security Gateway. Per Mandiant’s advisory, as quoted by SecurityWeek, a remote attacker can call the appliance’s configuration-import function, restore a crafted backup archive and change the global configuration. CVE-2026-111560 (CVSS 8.6) is a command injection in the timezone setting, in code shared by ESG, Load Balancer ADC, Message Archiver, WAF Control Center, Web Application Firewall and Web Security Gateway. With administrator rights, it runs OS commands as root.
Barracuda’s advisory says an attacker needs access to the appliance’s admin interface. It first listed the authentication bypass as needing administrator access and corrected that on November 5: CVE-2026-116606 needs no login, only a reachable admin interface, while CVE-2026-111560 requires administrator access. That is the chain: no login for the first flaw, root through the second. An admin interface that can be reached from outside is the precondition.
Barracuda released patches on November 2 and updated its advisory on November 9 to report exploitation. As of November 11, neither Barracuda nor CISA has published details of the attacks. Security firm Previdian reports 17 attempts against CVE-2026-116606 between November 9 and 11, from 15 IP addresses in three countries. Barracuda’s patch IDs are BNSF-40425 (ESG firmware 9.4.017 and later) or BNSF-40430 (earlier ESG firmware), BNADC-16586 for Load Balancer ADC and WAF, BNMA-32468 for Message Archiver, BNWF-60060 for WAF Control Center and BNYF-24789 for Web Security Gateway.
Why It Matters
An email gateway sits on the path of all inbound and outbound mail. Root on that box means the attacker controls the filter that is supposed to protect you, and can read or redirect what passes through. Barracuda appliances have been hit before: a 2023 campaign abused an ESG zero-day (CVE-2023-2868) for months, and Barracuda told customers to replace compromised devices.
The gap between patch and attack was one week. Appliances with automatic patching switched off, or an admin interface reachable from the internet, are the ones at risk. Assumption: many mid-sized companies installed the gateway once and left it alone. For NIS2-covered organizations, an exploited, unpatched mail gateway is a finding you will have to explain. It is the same pattern as our posts on the SonicWall SonicOS MFA bypass and the Zyxel switches: edge devices exploited within days of the fix.
What You Should Do Now
- Check that every Barracuda ESG, Load Balancer ADC, Message Archiver, WAF, WAF Control Center and Web Security Gateway has the November patch installed. Turn automatic patching back on if it was off. A device several firmware versions behind may need more than one update; Barracuda support can help.
- Test from outside your network whether the admin interface answers. If it does, restrict it to a management network or VPN today.
- Review the appliances for changes nobody made: a restored backup or configuration import in the logs, new admin accounts, an unusual timezone value, new outbound connections. Assumption: the timezone field is a likely place to look because it carries the command injection.
- If you find signs of compromise, treat the device as untrusted: involve Barracuda support, and rotate every credential stored on it, such as directory bind accounts and API keys.
DIESEC Perspective
The CVSS scores look moderate to high, not catastrophic, because each flaw has preconditions. The preconditions are exactly the weak spot in many setups: an admin interface that was never closed off and automatic updates that someone disabled years ago. So the fix is a patch plus an exposure review.
Not sure whether your mail gateway admin interface is reachable from outside? Contact DIESEC for an exposure assessment and patch verification of your edge appliances.
Sources: Barracuda | CISA | SecurityWeek | heise | BleepingComputer | SecurityWeek (patch release)
Published: 2026-11-12 | Category: Vulnerabilities & Patches | ~4 min read
