Barracuda Email Security Gateway Flaws CVE-2026-116606 and CVE-2026-111560 Chain From No Login to Root — Patched Before Any Known Exploitation

High · 2026-11-06 · By H.A

Barracuda Email Security Gateway Flaws CVE-2026-116606 and CVE-2026-111560 Chain From No Login to Root — Patched Before Any Known Exploitation

Barracuda has fixed an authentication bypass in the Email Security Gateway admin interface and a root command injection in code shared by six appliances; chained together, they give an unauthenticated attacker root on the gateway, so admin interfaces should be patched and locked down now.

Overview

Barracuda has fixed two vulnerabilities that can be chained to go from no credentials to root on its Email Security Gateway (ESG) appliances. CVE-2026-116606 (CVSS 4.0: 9.3) is an authentication bypass in the ESG admin interface. CVE-2026-111560 (CVSS 8.6) is an OS command injection in code shared by six Barracuda products. On ESG, an attacker who can reach the admin interface can use the pair to take full control of the appliance.

No exploitation in the wild and no public proof-of-concept had been reported as of 4 November 2026, and neither CVE is in CISA's KEV catalog yet. Still, ESG has a history: in 2023 a China-nexus group used two ESG zero-days to plant backdoors and steal mail, and nearly a third of the compromised appliances belonged to government agencies. Defenders should not wait for a KEV listing on these.

The Vulnerability

Affected products and fixes for the command-injection flaw:

Appliances several versions behind may need more than one update to reach a fixed build.

Timeline

Tradecraft

There is no attack activity to describe yet. Based on how ESG has been targeted before, likely tradecraft after a working exploit appears would be:

Detection

# External exposure check from an outside vantage point (replace with your appliance address)
curl -sk -o /dev/null -w '%{http_code}\n' https://esg.example.org:8000/

An HTTP response from outside your network means the admin interface is exposed and should be locked down first.

Recommended Actions

  1. Update ESG to 9.4.0.030 or later, and apply the listed patches to ADC, WAF, WSG, Message Archiver and WAF Control Center.
  2. Restrict admin interfaces to trusted internal management networks or a VPN, and never expose them directly to the internet.
  3. Confirm the appliances actually reached the fixed build. Older units may need several update steps.
  4. Collect a baseline of appliance configuration and logs now, so any later tampering can be spotted.
  5. If you find an unexplained configuration restore, treat the appliance as compromised. Lessons from the 2023 campaign showed that full replacement may be safer than in-place cleanup.

Analyst Assessment

These flaws have not been exploited yet. They are still a high priority, because email gateways sit at the edge of the network, handle every message and were heavily targeted by state-backed actors in 2023. A pre-authentication path to root on such a device is exactly what those actors look for. Now that patches are public, patch diffing could produce working exploits within days. Organizations with internet-reachable Barracuda admin interfaces face the greatest risk, and closing that exposure today matters as much as installing the update.

REEF SENTINEL