Table of contents
18
By Salman Khan, OSCP+, Founder of XHack, SRT (Synack Red Team member)
Read this in 30 seconds: CVE-2026-116606 is an authentication bypass in the Barracuda Email Security Gateway (ESG). It lets a remote attacker restore a crafted backup file and rewrite the appliance’s global configuration. Barracuda says it has been exploited together with a second bug, CVE-2026-111560, to reach root, and CISA added both to the Known Exploited Vulnerabilities catalog on 10 November 2026 with a federal due date of 13 November.
- Nobody agrees on “pre-authentication”. Barracuda’s advisory first said administrative access was required, then changed that on 5 November to “No (Administrative UI Access Required)”. Mandiant calls it unauthenticated, so the real condition is whether the admin interface can be reached.
- Exploitation is confirmed, but thin. Barracuda added a note on 9 November about “a small number of organizations”, with no count, no dates and no indicator list.
- CISA wants evidence kept. The catalog entry carries the forensic triage flag, so preserve logs and a configuration backup before you rebuild or wipe anything.
- Patching is necessary, not sufficient. Mandiant lists ESG versions before 9.4.0.030 as affected, Barracuda ships patch IDs BNSF-40425 and BNSF-40430, and older firmware may need more than one update.
- Assume the technique is public. One outlet reports that watchTowr published details and a proof of concept on 3 November, so an unpatched ESG with a reachable admin interface is a target now.
The bug is a missing gate on a backup restore, and the damage is whatever an attacker writes into your configuration.
Email gateways sit at the edge of a network and see every message. That makes them valuable to attackers and awkward to patch. CVE-2026-116606 is a good example of why, because the flaw is easy to describe and the response is not.
This article covers what CVE-2026-116606 is, what vendors and researchers have published, how it chains with CVE-2026-111560, what we know and do not know about attacks, who is exposed, how to fix it and how to check whether you were hit. It does not include exploit code or steps.
A mail gateway is trusted by design, so a flaw in its management plane is more serious than the same flaw on a normal server. It sees inbound and outbound mail, holds policy and routing settings, and often has accounts and keys that reach other systems.
Barracuda’s ESG is one of the best-known appliances in this class. Barracuda says it has more than 200,000 customers, according to BleepingComputer, and the ESG has been attacked before: CISA’s catalog lists CVE-2023-2868, an ESG flaw added on 26 May 2023.
That history shapes how to read CVE-2026-116606. An appliance flaw is not only a software bug. It can mean a device you may have to replace, not just patch, which is what Barracuda told customers with compromised units in 2023, as SecurityWeek and CSO Online both recall.
CVE-2026-116606 is an authentication bypass using an alternate path or channel (CWE-288) in the Barracuda Email Security Gateway. CISA’s catalog entry says an unauthenticated remote attacker could invoke a configuration-import function and restore a crafted, compatible backup archive, which modifies the appliance’s global configuration.
Here are the facts, with the source for each.
The second bug in the chain is CVE-2026-111560, an OS command injection (CWE-78) with a CVSS 4.0 score of 8.6, which affects ESG and five other Barracuda products. We cover it below, because you cannot assess the first bug without it.
We are describing this at the level Barracuda, Mandiant and CISA have published. We are not reproducing an exploit.
Step one is the bypass. According to Mandiant, the appliance has a function that restores a configuration from a backup archive. CVE-2026-116606 lets an unauthenticated attacker call it and restore a crafted archive, so the attacker can change the appliance’s global configuration without logging in. Mandiant does not say which check is missing.
Step two is the command injection. Mandiant’s advisory MNDT-2026-0041 says CVE-2026-111560 is improper neutralization of shell metacharacters in the timezone configuration field. An administrator can inject OS commands that run as root when the crafted timezone value is later processed.
How they fit together is our reading. On their own, CVE-2026-111560 needs an administrator, and CVE-2026-116606 lets an outsider write configuration. Barracuda says that chained, an attacker could bypass authorization controls and obtain root, and CISA says the two “can be chained”. Neither document publishes the exact route, so the idea that the bypass is what supplies the crafted configuration is our inference, consistent with those statements.
The most confusing part of CVE-2026-116606 is not the bug, it is the label. The sources describe the same flaw in three different ways.
| Source | What it says about authentication |
|---|---|
| Barracuda advisory, 2 November | Titled “Pre-Authentication Authorization Bypass”, yet the table first read “Yes, administrative access” |
| Barracuda advisory, 5 November update | Changed to “No (Administrative UI Access Required)”: no login needed, but the attacker must be able to reach the admin interface |
| Mandiant MNDT-2026-0042 | An unauthenticated remote attacker can invoke the import function |
| CISA catalog entry | “Unauthenticated remote attacker” |
| BleepingComputer, 6 November note | Barracuda updated the advisory to say attackers do not need admin privileges |
The simplest reading is this. You do not need an account, and you do need a network path to the admin interface. That is why Barracuda keeps saying that organizations whose administrative interfaces are not reachable from the internet are less exposed.
Frank Dickson of Dickson Research told CSO Online it likely means the interface is reachable without a password. Do not take comfort from the word “administrative” in the advisory.
Yes, by Barracuda’s own account, but almost everything else is unknown. Here is what the sources support.
What we do not know matters just as much.
Field Effect noted on 3 November that no exploitation had been reported at that point. That was true then and is out of date now, which is a good reminder to date every claim about this bug.
The 2023 ESG campaign is the closest comparison, and it is a warning about patching alone. CISA’s catalog holds three Barracuda entries out of 1,779. One is CVE-2023-2868 from May 2023, and two are the entries from this week.
BleepingComputer’s background on the 2023 case says the group UNC4841 exploited that zero-day for at least seven months and dropped malware called SeaSpy and Saltwater. SecurityWeek and CSO Online both recall that Barracuda told customers with compromised appliances to replace them rather than rely on a patch.
That does not mean CVE-2026-116606 will play out the same way, and no source says it is the same actor. It does mean that “we patched” and “we are clean” are different statements for an appliance, which is why the evidence steps below matter. Email gateways recur in our coverage, for example in CVE-2026-76519 in Cisco Secure Email Gateway.
You are exposed if you run an ESG on a firmware before the fix and an attacker can reach its admin interface. Barracuda’s patch table shows which products carry which bug.
| Product | CVE-2026-116606 | CVE-2026-111560 | Affected versions (Mandiant) | Patch ID (Barracuda) |
|---|---|---|---|---|
| Email Security Gateway | Yes | Yes | ESG earlier than 9.4.0.030 for CVE-2026-116606 | BNSF-40425 (9.4.017+), BNSF-40430 (before 9.4.017) |
| Load Balancer ADC | No | Yes | up to 6.4.0 | BNADC-16586 |
| Web Application Firewall | No | Yes | up to 11.0.1 | BNADC-16586 |
| Web Security Gateway | No | Yes | up to 16.1.100.100 | BNYF-24789 |
| Message Archiver | No | Yes | up to 5.5.4.0 | BNMA-32468 |
| WAF Control Center | No | Yes | up to 2.2.1 | BNWF-60060 |
Two cautions on versions. First, Mandiant’s threshold (9.4.0.030) and Barracuda’s patch IDs use different naming, and the advisory does not explain how they map, so rely on the firmware status your appliance reports, not on my reading of either list. Second, the other five products only have CVE-2026-111560, which needs an administrator, so their risk is lower unless an admin account is already compromised.
Restrict the admin interface first, patch second, and keep your evidence in between. Barracuda’s own guidance supports the first two, and CISA’s forensic flag supports the third.
No indicator list has been published, so the checks are behavioural. These are our suggestions, built from the advice of Field Effect and CSO Online. Run them only on appliances you own.
First, see whether the admin interface answers from outside your network. Run this from a host outside it, against your own appliance:
# Replace the placeholders with your own appliance and admin port.
curl -sk -o /dev/null -w "%{http_code}\n" --max-time 5 "https://<your-esg-address>:<admin-port>/"A response means the interface is reachable from that vantage point. No response from one location does not prove it is closed everywhere.
Then look at what changed. Compare the configuration backup you took against your last known-good backup, and read the exported logs for restore or import activity you did not run:
# Exported logs in ./esg-logs. Look for configuration restore or import events.
grep -i -E "restore|import|config" ./esg-logs/* | sort | tail -n 50Look at the timezone setting and other global settings for values that are not what you set, at admin accounts you do not recognise, and at unexpected outbound connections from the appliance. A hit proves less than it seems and a clean result proves less still, because a good attacker rewrites the configuration, not the logs.
If you find something, preserve everything, rotate credentials, and follow Barracuda’s support guidance before you restore a backup, because the backup may be the thing that was tampered with.
If I were scoping a test around CVE-2026-116606, I would start with one question: from the internet, or from a normal user network, with no credentials, can anything reach the management interface of a mail gateway, load balancer or firewall appliance? That is the condition that turns this bug from a footnote into an incident, and it is exactly the sort of unauthenticated exposure check a penetration test covers.
It is also a reminder of what a test report is. It tells you what was reachable on the day, and it does not certify that you are safe while appliance firmware keeps changing. Our AI VAPT services pair human testers with our AI agent for repeatable external-exposure checks across many devices, and managed testing starts at $2,500. A free consultation is open even if we turn out not to be the right fit.
Yes. Barracuda’s 9 November update says exploitation affects a small number of organizations, and CISA added CVE-2026-116606 to its catalog on 10 November. Neither gives a count, dates or an actor, and no indicator list is public.
No login is required, but the attacker needs access to the administrative interface. Barracuda changed its advisory on 5 November to “No (Administrative UI Access Required)”, and Mandiant and CISA describe an unauthenticated remote attacker. The practical rule is that an exposed admin interface is the risk.
Mandiant lists Barracuda Email Security Gateway versions earlier than 9.4.0.030, and only ESG is affected by this CVE. Barracuda’s patch IDs are BNSF-40425 for 9.4.017 and later and BNSF-40430 for earlier firmware. Check your appliance’s own firmware and patch status.
Patching closes the bug, but it does not tell you whether someone used it before you patched. Preserve logs and a configuration backup, review configuration changes and admin accounts, and rotate credentials if you suspect a compromise. Barracuda told customers in 2023 to replace compromised appliances.
CVE-2026-116606 affects only the Email Security Gateway. The chained bug, CVE-2026-111560, affects ESG, Load Balancer ADC, Web Application Firewall, Web Security Gateway, Message Archiver and WAF Control Center, and on those five it needs an administrator.
There is no published indicator list. Compare your configuration with a known-good backup, check logs for restore or import activity you did not run, look for unknown admin accounts and unexpected outbound connections, and test whether the admin interface was reachable from outside. A clean result lowers the risk but does not prove safety.
CVE-2026-116606 is a simple bug with a messy response. The label says pre-authentication, the advisory says administrative interface, and the practical truth is that an exposed admin interface on an unpatched ESG is a way in. Take the admin interface off the internet, patch to the fixed firmware, keep your logs and a configuration backup from before you changed anything, and look for configuration changes you did not make. A patch fixes the lock, but as one analyst put it to CSO Online, it does not tell you who already has a key.
Sources used: Barracuda advisory, Mandiant MNDT-2026-0042 and the CISA Known Exploited Vulnerabilities catalog.
Categories
Related articles
