HomeNovember 2026 patch cycleCVE-2026-116606: Barracuda ESG root chain exploited
Call: Patch nowCategory: Enterprise
CVE-2026-116606: Barracuda ESG root chain exploited
Part of November 2026 patch cycle
- Vendor
- Barracuda
- Products
- Barracuda Email Security Gateway, Barracuda Load Balancer ADC, Barracuda Message Archiver, Barracuda WAF, Barracuda WAF Control Center, and Barracuda Web Security Gateway
- Published
- Status
- Open
Call: Patch now. Barracuda patched these on November 2. On November 9 it updated its advisory: “We have identified exploitation activity affecting a small number of organizations.” CISA added both CVEs to KEV on November 10 with a due date of November 13. Three days. CISA doesn’t usually do that for fun.
What breaks: Two bugs that chain:
- CVE-2026-116606 (CVSS 9.3), ESG only: a pre-authentication authorization bypass. Barracuda changed the “Authentication Required” field on November 5 from “Yes” to “No (Administrative UI Access Required).” You don’t need credentials. You need to reach the admin UI. CISA’s description says it lets an attacker invoke a configuration-import function and restore a crafted backup archive.
- CVE-2026-111560 (CVSS 8.6): command injection on ESG, ADC, Message Archiver, WAF Control Center, WAF and Web Security Gateway. On its own it needs admin access. On ESG, the first bug supplies that.
Together, per Barracuda, they “could allow an attacker to bypass authorization controls and obtain root access to the device.”
Who’s hit: Anyone with one of those products whose admin UI an attacker can reach. ESG is the one with the full chain.
Fix: Barracuda’s patches:
- ESG: BNSF-40425 (firmware 9.4.017 and later) or BNSF-40430 (older than 9.4.017)
- ADC and WAF: BNADC-16586
- Message Archiver: BNMA-32468
- WAF Control Center: BNWF-60060
- Web Security Gateway: BNYF-24789
Most appliances take patches automatically. Check that yours did, especially if someone turned auto-patching off “temporarily” in 2023.
Workaround: Take the admin interface off the internet and restrict it to trusted internal networks. That’s Barracuda’s advice too. If yours was exposed, patching closes the door but doesn’t tell you who already came in. Barracuda hasn’t published indicators, so ask its support what to look for.
Sources: Barracuda advisory (opens in a new tab), Mandiant MNDT-2026-0042 (opens in a new tab), CISA KEV (opens in a new tab), The Register (opens in a new tab).
Sources
- https://trust.barracuda.com/security/pre-authentication-authorization-bypass-command-injection (opens in a new tab)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog (opens in a new tab)
- https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2026/MNDT-2026-0042.md (opens in a new tab)
- https://www.theregister.com/security/2026/11/10/barracudas-email-security-gateways-bitten-by-make-me-root-vulns/5308883 (opens in a new tab)