Skip to content
NewA calmer, faster ZeroHour
StoryExploit / PoCcriticalExploited in the wild

Barracuda ESG flaws exploited for root; federal deadline November 13

7 sources · 8 articlesFirst reported Updated ()
What's new

First merged summary.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

Attackers are exploiting two chained Barracuda Email Security Gateway flaws for root access; CISA set a November 13 federal deadline.

Barracuda confirmed attackers are chaining CVE-2026-116606, a pre-authentication authorization bypass, with CVE-2026-111560, an OS command injection, to run commands as root on Email Security Gateway when the admin interface is reachable. The injection flaw also affects Load Balancer ADC, Message Archiver, WAF, WAF Control Center, and Web Security Gateway, which have separate patches. Barracuda says a small number of organizations were hit and has not named attackers or victims. CISA added both flaws to the KEV catalog on November 10 with a November 13 federal deadline under BOD 26-04. The Hacker News reports ESG fixes in 9.4.0.030; GBHackers says 9.4.0.029; BleepingComputer cites patches BNSF-40425 and BNSF-40430.

Key facts
  • CVE-2026-116606 is CVSS 9.3; CVE-2026-111560 is CVSS 8.6.
  • Exploitation requires a reachable ESG Admin UI, Barracuda says.
  • ESG patches are BNSF-40425 for 9.4.017+ and BNSF-40430 for earlier.
  • CISA due date is November 13; known ransomware use is unknown.
  • Previdian saw 17 attempts from 15 IP addresses, November 9–11.
  • Flaws were disclosed November 2, then with no known exploitation.
Analyze CVE-2026-116606 with Vani AIImpact, affected versions, exploitation, mitigations and detection

Timeline

dated events in the reporting · oldest first
  1. Nov 2, 2026Flaws disclosed; Barracuda reported no active exploitation. · The Register
  2. Nov 9, 2026Barracuda confirmed active exploitation of the ESG flaws. · Cyber Security News
  3. Nov 10, 2026CISA added both CVEs to the KEV catalog. · CISA
  4. Nov 11, 2026Previdian logged 17 attempts from 15 IP addresses. · SecurityWeek
  5. Nov 13, 2026Federal agencies’ patch deadline under BOD 26-04. · CISA

What each outlet adds

beyond the shared facts
  • CISAKEV entries, November 13 deadline, ransomware use unknown.
  • BleepingComputerPatch IDs BNSF-40425 and BNSF-40430 and product coverage.
  • GBHackerswatchTowr research and a claimed fix in 9.4.0.029.
  • SecurityWeekPrevidian’s 17 attempts from 15 IPs in three countries.
  • The RegisterBarracuda declined to say whether attackers gained root.
CVEs
CVE-2026-116606CVE-2026-111560
Vendors
Barracuda NetworksBarracuda
Products
Email Security GatewayLoad Balancer ADCMessage ArchiverWAF Control CenterWeb Application FirewallWeb Security GatewayLoad BalancerApplication Delivery ControllerADCLoad Balancer Application Delivery Controller
Organizations
CISAPrevidianwatchTowr Labs

Coverage

oldest first · one row per article · UTC
  1. · 6d ago The Hacker NewsFirst report

    Barracuda Email Security Gateway flaws enable root access without login

    Two flaws chained allow root command execution without login; patches released for affected products.

  2. · 3d ago CISA Known Exploited Vulnerabilities

    CISA lists Barracuda OS command injection in KEV (CVE-2026-111560)

    An authenticated administrator can run root commands through a crafted timezone value; the federal due date is November 13.

  3. · 3d ago CISA Known Exploited Vulnerabilities

    CISA lists Barracuda ESG auth bypass in KEV (CVE-2026-116606)

    An unauthenticated attacker can restore a crafted backup and change global configuration; the due date is November 13.

  4. · 2d ago GBHackers

    Barracuda ESG flaws allow unauthenticated root command execution

    CVE-2026-116606 and CVE-2026-111560 are fixed in 9.4.0.029; in-the-wild exploitation is not reported.

  5. · 2d ago BleepingComputer

    Attackers exploit Barracuda ESG flaws to gain root access

    Barracuda says a small number of customers were hit after patches for CVE-2026-116606 and CVE-2026-111560 shipped a week earlier.

  6. · 2d ago Cyber Security News

    Barracuda confirms active exploitation of ESG flaws for root access

    CVE-2026-116606 and CVE-2026-111560 can chain to root if the admin interface is reachable; few organizations were hit.

  7. · 2d ago The Register · Security

    Attackers exploit Barracuda ESG bypass and command injection

    Barracuda says a small number of organizations were hit; chaining the bugs can yield root on the device.

  8. · 1d ago SecurityWeek

    Attackers exploit patched Barracuda flaws chained for root access

    CISA gave federal agencies three days to patch both flaws after attacks on a small number of organizations.

Vulnerabilities in this story

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2026-111560
Command Injection in Barracuda Appliance Timezone Field
8.66%KEV
KEV
CVE-2026-116606
Auth bypass in Barracuda Email Security Gateway before 9.4.0.030
9.39%KEVPoC
KEV