Barracuda Email Security Gateway: attackers are chaining two flaws to get root

What happened

Barracuda published a security advisory about two flaws in its appliances on 2 November 2026. On 9 November (US evening) it updated the advisory to say it had identified exploitation activity affecting a small number of organisations. According to the vendor, chaining the two flaws lets an attacker bypass authorization controls and gain root on the device.

The product hit hardest is the Barracuda Email Security Gateway (ESG) – a mail gateway that sits between the internet and corporate email and sees every inbound and outbound message. Both flaws affect it. The second one also affects other Barracuda appliances.

Technical details

According to NVD and Mandiant's advisory, CVE-2026-116606 is an authentication bypass (CWE-288). An unauthenticated attacker can reach the configuration import function, restore a crafted but compatible backup and thereby change the appliance's global configuration. On 5 November Barracuda clarified that the flaw needs no authentication, but does require access to the administrative UI.

CVE-2026-111560 is an OS command injection (CWE-78). An administrator can supply a crafted value in the timezone field, which the appliance passes to a shell and runs with root privileges. On its own it requires admin rights – which the first flaw hands the attacker.

Researchers at watchTowr Labs analysed both flaws from the patches on 5 November. In their reading, the login page doesn't stop processing a request after a failed password change, so the request carries on with the limited role of the login screen. That role is enough to restore a backup. The timezone value from the backup then reaches scripts that insert it into a command run through sudo. watchTowr says the backup checksum uses no secret, so an attacker can compute it. We don't publish exploitation steps.

Who is affected

• Barracuda Email Security Gateway – both flaws. NVD and Mandiant list versions before 9.4.0.030. Barracuda's patches are BNSF-40425 (for 9.4.017 and later) and BNSF-40430 (for earlier versions).
• Load Balancer ADC and Web Application Firewall – CVE-2026-111560, patch BNADC-16586.
• Message Archiver (BMA) – CVE-2026-111560, patch BNMA-32468.
• WAF Control Center – CVE-2026-111560, patch BNWF-60060.
• Web Security Gateway – CVE-2026-111560, patch BNYF-24789.

Appliances with an internet-facing admin interface are most at risk. On products other than ESG, exploitation requires admin credentials, because the first flaw doesn't apply to them.

How to tell if you were compromised

Barracuda has not published indicators of compromise – no IP addresses, file hashes or description of post-exploitation activity. watchTowr's write-up doesn't list any either.

What we'd check (our own recommendations, not vendor guidance):

• Backup restores and configuration changes nobody on your team made, especially since late October. Look in the appliance's audit logs for configuration imports and timezone changes.
• Admin interface access from unfamiliar addresses in firewall or reverse proxy logs.
• Unusual outbound connections from the appliance itself (to addresses that belong neither to Barracuda nor to your mail servers).
• Mail rules: new forwarding, filtering exceptions or copies of messages sent to outside addresses.

If anything looks wrong, contact Barracuda Support (support@barracuda.com) and treat the appliance as compromised – an attacker with root on a mail gateway can read email and change settings. If the vendor or a CERT later publishes indicators, you can pull them out of the advisory with our IOC extractor. To check the scores from the vectors, use our CVSS calculator.

What to do

1. Check firmware and patches. The appliance shows the latest available version. On ESG, BNSF-40425 must be applied, or BNSF-40430 on versions earlier than 9.4.017.
2. Apply patches manually if they weren't applied automatically, and re-enable automatic patching if you turned it off.
3. Outdated firmware: if the appliance is several versions behind, it may need more than one update. Barracuda recommends contacting support in that case.
4. Restrict the admin interface to trusted internal networks and control access with network rules.
5. After patching, run the checks from the previous section. A patch closes the hole but doesn't remove anything an attacker may have left behind.

Timeline

Updates

• 10 November 2026, evening – CISA added CVE-2026-116606 and CVE-2026-111560 to its Known Exploited Vulnerabilities (KEV) catalog. US federal agencies must patch by 13 November 2026, well inside the usual three weeks. CISA notes the two flaws can be chained. Known ransomware use is listed as unknown. Neither Barracuda nor Mandiant has released indicators of compromise yet.
• 10 November 2026 – first version of this article.