Barracuda ESG auth bypass CVE-2026-116606 exploited, chains with CVE-2026-111560

CISA has added two Barracuda vulnerabilities, CVE-2026-116606 and CVE-2026-111560, to its Known Exploited Vulnerabilities catalog, which means both are being exploited in the wild. The first is an unauthenticated authentication bypass in Barracuda Email Security Gateway (ESG) rated CVSS 9.3, and CISA’s catalog entry says it can be chained with the second flaw, an OS command injection. Federal agencies must apply mitigations by 13 November 2026, and any organisation running these appliances should treat that date as its own.

What happened

CISA added both entries to the KEV catalog on 10 November 2026. NVD published the records on 2 November 2026. Each CISA entry states that the flaw can be chained with the other one.

• CVE-2026-116606 (CWE-288, authentication bypass using an alternate path or channel): an unauthenticated remote attacker can call a configuration-import function and restore a crafted, compatible backup archive. The result is unauthorised modification of the appliance’s global configuration.
• CVE-2026-111560 (CWE-78, OS command injection): an authenticated administrator can place shell metacharacters in the timezone configuration field, and the commands run with root privileges when that value is processed. NVD scores it CVSS 8.6 (high).

Put together, the two flaws describe a path from an unauthenticated network request to root-level command execution on the appliance. CISA lists the chaining; neither entry describes specific attacks, victims or attackers, and CISA records ransomware use as unknown.

Am I affected?

CVE-2026-116606 affects Email Security Gateway 300, 400, 600, 800 and 900 firmware earlier than 9.4.0.030. CVE-2026-111560 reaches further. NVD lists these as affected below the fixed versions:

• Email Security Gateway 300, 400, 600, 800 and 900 firmware before 9.4.0.029
• Web Application Firewall before 12.3.1.002
• Web Security Gateway firmware before 15.0.0.009
• Load Balancer ADC firmware before 6.4
• Message Archiver firmware before 5.5.4.002

CISA’s description of the command injection also names the WAF Control Center as an affected product; check Barracuda’s advisory for that product.

Technical details: how serious is it?

The CVSS 4.0 vector for CVE-2026-116606 shows network attack, low complexity, no privileges and no user interaction, with high impact on confidentiality, integrity and availability. That is the profile of a flaw that can be scanned for and used at scale against exposed appliances. The command injection needs administrator access (privileges required: high), which is why its score is lower. Its value to an attacker is that the bypass can supply the foothold.

EPSS, the model that estimates the chance of exploitation in the next 30 days, gives CVE-2026-116606 about 1.6% and CVE-2026-111560 about 1.1%. Treat those figures cautiously: KEV listing already confirms exploitation, which matters more for prioritisation than a probability score.

Why this matters

This section is our analysis, not additional reporting. Mail gateways sit at the network edge, handle sensitive traffic and are often reachable from the internet. Control of the gateway’s configuration can mean control over how mail is filtered, routed and logged, which is a strong position for an attacker. Appliances like this also tend to run outside normal endpoint monitoring, so a compromise can go unseen for a long time. With a three-day deadline from KEV addition, patching within hours is the right target for any internet-facing unit.

What to do

1. Inventory every Barracuda ESG, WAF, Web Security Gateway, Load Balancer ADC and Message Archiver, including units in branch offices and test labs.
2. Upgrade to the fixed firmware: ESG 9.4.0.030 or later (the second flaw needs at least 9.4.0.029), WAF 12.3.1.002, Web Security Gateway 15.0.0.009, Load Balancer ADC 6.4 and Message Archiver 5.5.4.002.
3. Follow the mitigation steps in Barracuda’s security advisory. CISA’s required action is to apply the vendor’s mitigations and, where none are available, to stop using the product.
4. Restrict management interfaces so they are not reachable from the internet, and review who holds administrator accounts.
5. Hunt for compromise before and after patching. Look for unexpected configuration imports or restores, configuration changes you did not make, new or changed administrator accounts, edits to the timezone setting, and unfamiliar processes or outbound connections from the appliance. Patching does not remove an attacker who is already in.
6. If you find signs of tampering, treat the appliance as compromised: preserve evidence, rebuild from a known-good state and rotate credentials and keys that were stored on it.

Neither source names an exploitation campaign, a threat actor or indicators of compromise, so detection has to rest on configuration and account changes rather than known signatures.

Related coverage

• GPUStack auth bypass CVE-2026-102895 added to CISA KEV
• Ivanti Connect Secure auth bypass added to CISA KEV (CVE-2026-104935)
• Collabora CODE Server flaw exploited in Nextcloud (CVE-2026-110447)

Sources

• FIRST EPSS
• CISA KEV: CVE-2026-116606
• CISA KEV: CVE-2026-111560
• NVD: CVE-2026-116606
• NVD: CVE-2026-111560
• Barracuda security advisory