Skip to content
NewA calmer, faster ZeroHour
StoryExploit / PoCcriticalExploited in the wild

Barracuda ESG flaws chained for root; limited exploitation confirmed

9 sources · 10 articlesFirst reported Updated ()
What's new

First merged summary.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

Barracuda and CISA say attackers are exploiting two ESG flaws that can chain to root; federal patching is due November 13.

Barracuda Email Security Gateway flaws CVE-2026-116606 and CVE-2026-111560 can be chained so an attacker who can reach the Admin UI changes configuration and runs commands as root. CVE-2026-116606 is a pre-authentication authorization bypass scored 9.3; CVE-2026-111560 is command injection scored 8.6 and also affects ADC, Message Archiver, WAF, WAF Control Center, and Web Security Gateway. Barracuda disclosed the issues on November 2 with no known exploitation, then on November 9 said a small number of organizations were hit. It has not named attackers or said whether root was obtained. CISA added both to the KEV catalog on November 10 with a November 13 federal deadline. Outlets disagree on the ESG fix: 9.4.0.029, 9.4.0.030, or patches BNSF-40425 and BNSF-40430.

Key facts
  • CVE-2026-116606, CVSS 9.3, lets attackers restore a crafted backup.
  • CVE-2026-111560, CVSS 8.6, can run injected OS commands as root.
  • Barracuda says a small number of organizations were compromised.
  • CISA set a November 13 federal deadline under BOD 26-04.
  • SecurityWeek cites Previdian: 17 attempts from 15 IP addresses.
  • Barracuda rates both High, while published scores are 9.3 and 8.6.
Analyze CVE-2026-116606 with Vani AIImpact, affected versions, exploitation, mitigations and detection

Timeline

dated events in the reporting · oldest first
  1. Nov 2, 2026Barracuda disclosed the flaws with no known exploitation. · Cyber Security News
  2. Nov 9, 2026Barracuda confirmed exploitation at some organizations. · Cyber Security News
  3. Nov 10, 2026CISA added both CVEs to the KEV catalog. · CISA Known Exploited Vulnerabilities
  4. Nov 11, 2026Previdian recorded exploit attempts through this date. · SecurityWeek

What each outlet adds

beyond the shared facts
  • watchTowr LabsSays ESG 9.4.0.027 is fixed in 9.4.0.029.
  • The Hacker NewsReports ESG fixes in version 9.4.0.030 and later.
  • BleepingComputerNames ESG patches BNSF-40425 and BNSF-40430.
  • CISA Known Exploited VulnerabilitiesKEV listings, November 13 deadline, ransomware use unknown.
  • SecurityWeekPrevidian saw 17 attempts from 15 addresses in three countries.
CVEs
CVE-2026-116606CVE-2026-111560
Vendors
Barracuda NetworksBarracuda
Products
Email Security GatewayLoad Balancer ADCMessage ArchiverWAF Control CenterWeb Application FirewallWeb Security GatewayLoad BalancerApplication Delivery ControllerADCLoad Balancer Application Delivery Controller
Organizations
CISAPrevidianwatchTowr Labs

Coverage

oldest first · one row per article · UTC
  1. · 6d ago Security AffairsFirst report

    Barracuda patches two chained flaws for root access

    Barracuda released patches for CVE-2026-116606 and CVE-2026-111560 in ESG appliances that can be combined to grant attackers full root access.

  2. · 5d ago watchTowr Labs

    Barracuda Email Security Gateway Pre-Auth RCE Discovered

    Chained CVE-2026-116606 and CVE-2026-111560 enable pre-auth remote root code execution on Barracuda ESG 9.4.0.027.

  3. · 5d ago The Hacker News

    Barracuda Email Security Gateway flaws enable root access without login

    Two flaws chained allow root command execution without login; patches released for affected products.

  4. · 1d ago CISA Known Exploited Vulnerabilities

    CISA lists Barracuda OS command injection in KEV (CVE-2026-111560)

    An authenticated administrator can run root commands through a crafted timezone value; the federal due date is November 13.

  5. · 1d ago CISA Known Exploited Vulnerabilities

    CISA lists Barracuda ESG auth bypass in KEV (CVE-2026-116606)

    An unauthenticated attacker can restore a crafted backup and change global configuration; the due date is November 13.

  6. · 1d ago GBHackers

    Barracuda ESG flaws allow unauthenticated root command execution

    CVE-2026-116606 and CVE-2026-111560 are fixed in 9.4.0.029; in-the-wild exploitation is not reported.

  7. · 1d ago BleepingComputer

    Attackers exploit Barracuda ESG flaws to gain root access

    Barracuda says a small number of customers were hit after patches for CVE-2026-116606 and CVE-2026-111560 shipped a week earlier.

  8. · 1d ago Cyber Security News

    Barracuda confirms active exploitation of ESG flaws for root access

    CVE-2026-116606 and CVE-2026-111560 can chain to root if the admin interface is reachable; few organizations were hit.

  9. · 1d ago The Register · Security

    Attackers exploit Barracuda ESG bypass and command injection

    Barracuda says a small number of organizations were hit; chaining the bugs can yield root on the device.

  10. · 12h ago SecurityWeek

    Attackers exploit patched Barracuda flaws chained for root access

    CISA gave federal agencies three days to patch both flaws after attacks on a small number of organizations.

Vulnerabilities in this story

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2026-111560
Command Injection in Barracuda Appliance Timezone Field
8.61%KEV
KEV
CVE-2026-116606
Auth bypass in Barracuda Email Security Gateway before 9.4.0.030
9.32%KEVPoC
KEV