AllTech
On this page
Field notes from the engineering team
On November 10, 2026, CISA added two Barracuda vulnerabilities to its Known Exploited Vulnerabilities catalog: CVE-2026-116606 and CVE-2026-111560. Barracuda published its advisory on November 2 and said on November 9 that it had seen exploitation affecting a small number of organizations.
Used together, the two flaws let an attacker who can reach the administrative interface of a Barracuda Email Security Gateway (ESG) take over the appliance with root access. If your organization filters mail through a Barracuda appliance, or a vendor runs one for you, this is the one to check today.
The short version
| Item | Detail |
|---|---|
| CVEs | CVE-2026-116606 and CVE-2026-111560 |
| CVE-2026-116606 | Authorization bypass in the ESG. Barracuda rates it High, CVSS 9.3. No login is needed, but the attacker must be able to reach the administrative interface (Admin UI). |
| CVE-2026-111560 | OS command injection through the timezone setting. Barracuda rates it High, CVSS 8.6. It needs administrator access, and the injected commands run as root. |
| Affected | ESG for both flaws. The command injection also affects Load Balancer ADC, Message Archiver, WAF Control Center, Web Application Firewall and Web Security Gateway. |
| Fix | Barracuda patches for the ESG: BNSF-40425 (9.4.017 and later) and BNSF-40430 (earlier than 9.4.017). Barracuda lists a patch for each of the other products too. Update every affected product to its latest firmware. |
| Exploitation | Barracuda reports exploitation against a small number of organizations. CISA added both flaws to the KEV catalog on November 10, 2026. |
How the two flaws fit together
The first flaw is the way in. Mandiant, which published the technical advisory, describes it as an authentication bypass in the ESG. An unauthenticated attacker can call the configuration-import function and restore a crafted backup archive. That changes the appliance’s global configuration without a login.
The second flaw is the step up. The timezone field in the administrative settings does not neutralize shell characters. An administrator can put commands in that field, and the appliance runs them with root privileges when it later processes the value.
On their own, the second flaw needs admin rights and the first changes configuration. Chained, as Barracuda and CISA both note, they take an attacker from the network to root on the device. Barracuda’s advisory says the attacker needs access to the Admin UI. That makes an admin page open to the internet the key risk.
The advisory and the Mandiant write-ups do not say what attackers did after they got in, so we do not either.
Which products and versions are affected
Mandiant lists these versions as affected by the command injection:
| Product | Affected versions |
|---|---|
| Email Security Gateway (ESG) | 9.4.0.27 and earlier |
| Load Balancer ADC | 6.4.0 and earlier |
| Web Application Firewall (WAF) | 11.0.1 and earlier |
| Web Security Gateway (WSG) | 16.1.100.100 and earlier |
| Message Archiver (BMA) | 5.5.4.0 and earlier |
| WAF Control Center (WCC) | 2.2.1 and earlier |
For the authorization bypass, Mandiant lists the ESG earlier than 9.4.0.030. Barracuda’s own table names patch BNSF-40425 for 9.4.017 and later and BNSF-40430 for earlier versions. The two sources number the ESG releases differently, so do not rely on a version cutoff from this post. Install the latest firmware Barracuda offers for your product and confirm in the Barracuda advisory that your release is covered.
What to do
1. Find out whether you run one. Ask your IT provider: “Do we have any Barracuda appliances (email gateway, web filter, web application firewall, load balancer or message archiver), and which firmware are they on?” Include virtual appliances and units in a branch office.
2. Update the firmware. Barracuda’s remediation for both CVEs is to upgrade to the latest firmware. Barracuda says a device that is several versions behind may need more than one update, and that devices with automatic patching turned off should have it turned back on. Federal agencies had until November 13, 2026 to do this under CISA’s directive. A private organization has no deadline, but the same urgency applies once exploitation is confirmed.
3. Take the admin interface off the internet. Barracuda says exploitation needs access to the Admin UI and recommends limiting that access to trusted internal networks. Our advice: allow management only from a small set of internal addresses or through a VPN or zero trust access path, and never from the open internet.
4. Look for signs of tampering. Our advice: review the appliance’s configuration against your last known-good backup. Look for settings you did not change, new or unfamiliar administrator accounts, a timezone value that contains odd characters, and configuration restores you did not start. A clean result is not proof of a clean device, so keep the appliance’s logs.
5. Rotate credentials if the admin page was exposed. If the interface was reachable from the internet before you patched, change the administrator passwords and any other credentials stored on the appliance. Patching does not take back anything an attacker has already read.
6. Ask whether you need the appliance. An email filter you host yourself is one more server to patch and watch. Cloud-delivered email security in front of Microsoft 365 removes that device from your network.
How we help
Knowing which devices run which firmware is the job of remote monitoring and patching. Filtering phishing and malware before it reaches a mailbox is what our email security service does, and it is delivered from the cloud, so there is no mail gateway in your server closet to patch. Odd logins and configuration changes on an exposed device are the kind of signal our managed SOC reviews. If an appliance may have been taken over, incident response covers isolating it, preserving evidence and resetting credentials.
For law firms, healthcare practices and municipalities, mail carries privileged, patient and public-records information, so the system that filters it deserves the same care as the mailboxes. If you are not sure what sits in front of your email, ask us and we will help you find out.
We covered another exploited flaw in a network gateway recently in SonicWall SSLVPN CVE-2026-19868: SAML Bypass.
Sources
- Barracuda Networks: Pre-Authentication Authorization Bypass and Command Injection Vulnerabilities in Certain Barracuda Products (updated November 9, 2026)
- Mandiant advisory MNDT-2026-0042 (CVE-2026-116606)
- Mandiant advisory MNDT-2026-0041 (CVE-2026-111560)
- CISA Known Exploited Vulnerabilities Catalog (entries added November 10, 2026)
- NVD: CVE-2026-116606
- NVD: CVE-2026-111560
