Barracuda ESG Chain CVE-2026-116606 and CVE-2026-111560 Now Exploited: No Login to Root on Email Gateways, CISA Sets a Three-Day Deadline
Barracuda now says attackers have exploited its patched Email Security Gateway authorization-bypass and command-injection chain against a small number of organisations, and CISA has given federal agencies until 13 November to fix it.
Barracuda has confirmed that attackers are now exploiting the two Email Security Gateway (ESG) flaws it patched at the start of November. Chained together, CVE-2026-116606 and CVE-2026-111560 take an attacker from no login to root on the appliance. CISA added both to its Known Exploited Vulnerabilities (KEV) catalog on 10 November 2026 and gave US federal civilian agencies until 13 November to fix them, an unusually short three-day window.
What Is New
When Barracuda released the fixes on 2 November, there was no known exploitation, no KEV listing and no public exploit code. Researchers had published only a detection tool that checks whether an appliance is vulnerable.
That changed with a Barracuda advisory update posted on the evening of 9 November (10 November UTC). The update says the chain has been exploited against "a small number of organizations". CISA followed within hours. One report claims exploitation began after a public proof-of-concept appeared. Other sources have not confirmed this, and Barracuda has not said how attackers built their exploit.
Barracuda has not disclosed how many organisations were hit, what the attackers did after gaining access, or any indicators of compromise. No threat actor has been publicly linked to the activity.
Technical Details
CVE-2026-116606 is an authorization bypass in ESG, rated 9.3 under CVSS v4.0. In a 5 November correction, Barracuda clarified that it needs no authentication, but the attacker must be able to reach the appliance's administrative interface.
CVE-2026-111560 is an OS command injection tied to the timezone setting, rated 8.6. On its own it requires administrative access. Combined with the authorization bypass, that requirement disappears.
Together, the two flaws let an unauthenticated attacker who can reach the admin UI run commands as root and take full control of the gateway.
Who Is Affected
- Email Security Gateway is the only product exposed to the full no-login-to-root chain.
- CVE-2026-111560 alone also affects five other Barracuda product lines: Load Balancer ADC, Message Archiver, WAF Control Center, Web Application Firewall and Web Security Gateway. On those products an attacker needs admin access first. Exploitation still matters if admin credentials are weak, reused or stolen.
Email gateways sit in the path of all inbound and outbound mail. An attacker with root on one can read, copy or tamper with messages, harvest credentials and use the device as a trusted foothold inside the network. Barracuda ESG has been targeted before: in 2023 a state-backed group exploited a different ESG zero-day so deeply that the vendor told customers to replace affected appliances. No link between that campaign and the current activity has been established.
Patch Status
Barracuda released patches on 2 November 2026. Its advisory lists the ESG fixes as:
- BNSF-40425 for firmware 9.4.017 and later
- BNSF-40430 for firmware older than 9.4.017
Some reports instead cite a fixed firmware number, so check the patch level against Barracuda's own advisory table rather than a single version string. The other five product lines have their own product-specific patches, listed in the same advisory.
What To Do Now
- Verify, don't assume. Confirm the correct patch is installed on every ESG, including standby or high-availability nodes and appliances at remote sites. Don't rely on automatic updates alone.
- Lock down the admin interface. It should only be reachable from a trusted management network. Review firewall rules, NAT and remote-access exceptions that may expose it to the internet.
- Patch the other product lines (ADC, Message Archiver, WAF, WAF Control Center, Web Security Gateway) for CVE-2026-111560, and rotate admin passwords on them.
- Triage for compromise. If the admin UI was ever exposed, or you see unexplained configuration changes (especially to timezone or system settings), new admin accounts or unusual outbound connections from the gateway, preserve logs and configuration and start incident response. CISA's KEV entries for both flaws call for forensic triage, not just patching.
- Check mail flow and rules after recovery for unexpected forwarding, journaling or relay settings that could silently copy mail.
Why It Matters
This is the familiar pattern of a patched edge-device bug turning into an exploited one within about a week. CISA's three-day deadline shows how seriously the agency takes this chain. Email security appliances are trusted, internet-facing and see sensitive data, which makes them an ideal target.
Organisations that marked these CVEs as "patch in the next cycle" when they were disclosed should move them to the top of the queue. Patching after a compromise does not remove an attacker who is already on the box, so anyone who was exposed should also check for compromise.
