Skip to content
NewA calmer, faster ZeroHour
StoryExploit / PoCcriticalExploited in the wild

Barracuda ESG flaws chained for root; CISA lists both as exploited

8 sources · 9 articlesFirst reported Updated ()
What's new

First merged summary.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

Barracuda says a small number of ESG customers were hit by two chained flaws now on CISA’s KEV list, due November 13.

Barracuda Email Security Gateway flaws CVE-2026-116606 and CVE-2026-111560 can be chained so an attacker who can reach the Admin UI bypasses authorization and runs commands as root. Barracuda said on November 9 that a small number of organizations were affected, after reporting no active exploitation on November 2. CISA added both bugs to the Known Exploited Vulnerabilities catalog on November 10, with a federal due date of November 13, and says ransomware use is unknown. watchTowr Labs and GBHackers say ESG fixes are in 9.4.0.029; The Hacker News says 9.4.0.030 and later. BleepingComputer and Cyber Security News cite patches BNSF-40425 and BNSF-40430. The command-injection flaw also affects several other Barracuda products.

Key facts
  • CVE-2026-116606 is a pre-auth bypass scored CVSS 9.3.
  • CVE-2026-111560 is OS command injection scored CVSS 8.6.
  • CISA KEV due date for both flaws is 2026-11-13.
  • Barracuda says only a small number of organizations were hit.
  • Injection also affects ADC, BMA, WAF, WCC, WSG, and Load Balancer.
Analyze CVE-2026-116606 with Vani AIImpact, affected versions, exploitation, mitigations and detection

Timeline

dated events in the reporting · oldest first
  1. Nov 2, 2026Barracuda disclosed the flaws and reported no active exploitation. · Cyber Security News
  2. Nov 5, 2026watchTowr detailed the pre-auth root chain on ESG 9.4.0.027. · watchTowr Labs
  3. Nov 9, 2026Barracuda confirmed exploitation at a small number of organizations. · Cyber Security News
  4. Nov 10, 2026CISA added both CVEs to KEV; federal due date November 13. · CISA Known Exploited Vulnerabilities
  5. Nov 11, 2026Previdian reported 17 attempts from 15 IPs since November 9. · SecurityWeek

What each outlet adds

beyond the shared facts
  • CISA Known Exploited VulnerabilitiesKEV listing, November 13 due date, ransomware use unknown.
  • BleepingComputerPatch IDs BNSF-40425 and BNSF-40430; Admin UI advice.
  • The Hacker NewsSays ESG fixes start at 9.4.0.030, not 9.4.0.029.
  • SecurityWeekPrevidian saw 17 attempts from 15 IPs in three countries.
  • The RegisterBarracuda declined to say whether attackers gained root or who attacked.
CVEs
CVE-2026-116606CVE-2026-111560
Vendors
Barracuda NetworksBarracuda
Products
Email Security GatewayLoad Balancer ADCMessage ArchiverWAF Control CenterWeb Application FirewallWeb Security GatewayLoad BalancerApplication Delivery ControllerADCLoad Balancer Application Delivery Controller
Organizations
CISAPrevidianwatchTowr Labs

Coverage

oldest first · one row per article · UTC
  1. · 6d ago watchTowr LabsFirst report

    Barracuda Email Security Gateway Pre-Auth RCE Discovered

    Chained CVE-2026-116606 and CVE-2026-111560 enable pre-auth remote root code execution on Barracuda ESG 9.4.0.027.

  2. · 5d ago The Hacker News

    Barracuda Email Security Gateway flaws enable root access without login

    Two flaws chained allow root command execution without login; patches released for affected products.

  3. · 1d ago CISA Known Exploited Vulnerabilities

    CISA lists Barracuda OS command injection in KEV (CVE-2026-111560)

    An authenticated administrator can run root commands through a crafted timezone value; the federal due date is November 13.

  4. · 1d ago CISA Known Exploited Vulnerabilities

    CISA lists Barracuda ESG auth bypass in KEV (CVE-2026-116606)

    An unauthenticated attacker can restore a crafted backup and change global configuration; the due date is November 13.

  5. · 1d ago GBHackers

    Barracuda ESG flaws allow unauthenticated root command execution

    CVE-2026-116606 and CVE-2026-111560 are fixed in 9.4.0.029; in-the-wild exploitation is not reported.

  6. · 1d ago BleepingComputer

    Attackers exploit Barracuda ESG flaws to gain root access

    Barracuda says a small number of customers were hit after patches for CVE-2026-116606 and CVE-2026-111560 shipped a week earlier.

  7. · 1d ago Cyber Security News

    Barracuda confirms active exploitation of ESG flaws for root access

    CVE-2026-116606 and CVE-2026-111560 can chain to root if the admin interface is reachable; few organizations were hit.

  8. · 1d ago The Register · Security

    Attackers exploit Barracuda ESG bypass and command injection

    Barracuda says a small number of organizations were hit; chaining the bugs can yield root on the device.

  9. · 13h ago SecurityWeek

    Attackers exploit patched Barracuda flaws chained for root access

    CISA gave federal agencies three days to patch both flaws after attacks on a small number of organizations.

Vulnerabilities in this story

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2026-111560
Command Injection in Barracuda Appliance Timezone Field
8.61%KEV
KEV
CVE-2026-116606
Auth bypass in Barracuda Email Security Gateway before 9.4.0.030
9.32%KEVPoC
KEV