Skip to content
NewA calmer, faster ZeroHour
Exploit / PoChighExploited in the wild

Barracuda confirms active exploitation of ESG flaws for root access

Original title: Barracuda Confirms Active Exploitation of Email Gateway Flaws Allowing Unauthenticated Root Access

Cyber Security Newsby Guru Baran ()2 min read
Read at cybersecuritynews.com
Part of a story covered by 10 sourcesBarracuda ESG flaws chained for root; limited exploitation confirmedMerged summary & timeline
AI summary · x-ai/grok-4.7Summaries by Vani AI

CVE-2026-116606 and CVE-2026-111560 can chain to root if the admin interface is reachable; few organizations were hit.

On November 9, Barracuda said attackers are combining an authorization bypass and command injection in Email Security Gateway to gain root without logging in. CVE-2026-116606, CVSS 9.3, needs no credentials but requires reachability of the administrative interface; CVE-2026-111560, CVSS 8.6, needs admin access unless chained. ESG customers need BNSF-40425 or BNSF-40430, and related products have separate patches. Barracuda did not name attackers, malware, or victims.

Unconfirmed: Barracuda has not identified the attackers, affected organizations, malware, or exact victim count.

Key facts
  • Barracuda rates both flaws High and says a small number of organizations were affected.
  • ESG 9.4.017 and later need BNSF-40425; earlier versions need BNSF-40430.
  • Command injection also affects Load Balancer ADC and Web Application Firewall via BNADC-16586.
  • Message Archiver, WAF Control Center, and Web Security Gateway have separate patches.
  • The flaws were disclosed November 2; active exploitation was confirmed November 9.
Security assessment · AI, from the articleExploited in the wild

Impact: Unauthenticated root access if the ESG admin interface is reachable

ProductAffectedFixed in
Barracuda Email Security Gateway—BNSF-40425 for 9.4.017 and later; BNSF-40430 for earlier versions
Barracuda Load Balancer Application Delivery Controller—BNADC-16586
Barracuda Web Application Firewall—BNADC-16586
Barracuda Message Archiver—BNMA-32468
Barracuda WAF Control Center—BNWF-60060
Barracuda Web Security Gateway—BNYF-24789
What to do
  1. 1.Install BNSF-40425 or BNSF-40430 on ESG and the named product-specific patches.
  2. 2.Restrict administrative interfaces to trusted internal networks.
  3. 3.Enable automatic patching where disabled and verify current firmware.
Analyze CVE-2026-116606 with Vani AIImpact, affected versions, exploitation, mitigations and detection
CVEs
CVE-2026-116606CVE-2026-111560
ATT&CK
T1190 Exploit Public-Facing Application
Tags
barracudaemail-security-gatewaycommand-injectionauthorization-bypassroot-access
Vendors
Barracuda
Products
Email Security GatewayLoad Balancer Application Delivery ControllerWeb Application FirewallMessage ArchiverWAF Control CenterWeb Security Gateway

Vulnerabilities mentioned

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2026-111560
Command Injection in Barracuda Appliance Timezone Field
8.61%KEV
KEV
CVE-2026-116606
Auth bypass in Barracuda Email Security Gateway before 9.4.0.030
9.32%KEVPoC
KEV

From the original article

2 min read at cybersecuritynews.com

Barracuda has confirmed active exploitation of security flaws affecting its Email Security Gateway (ESG), warning that attackers could combine two vulnerabilities to gain root access without logging in. In a November 9, 2026, update issued at 9:00 p. m.

Cyber Security News

By Guru Baran · cybersecuritynews.com

Read the full article at Cyber Security News

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.