Barracuda ESG Flaw (CVE-2026-116606): Two Bugs Chained to Root Without Login, Check Your Patch

CVE-2026-116606 is an authorization bypass vulnerability in Barracuda Email Security Gateway (ESG) that, when chained with command injection CVE-2026-111560, gives attackers root access without login. Barracuda released a patch on November 2, 2026, confirmed the exploit on November 9, and CISA included both in its Known Exploited Vulnerabilities (KEV) catalog on November 10, 2026.

The email gateway holds all of the organization's incoming and outgoing mail, so taking over the appliance means the email contents, credentials, and paths to the internal network are exposed. This article summarizes how the chain works, which products are affected, the name of the patch that must be installed, and the checking steps you can take today.

Quick summary

How does this loophole work?

This flaw works by combining two weaknesses: the first opens admin features without logging in, the second changes that feature to executing commands as root. Each bug has its own limitations, but together those limitations disappear.

First bug: leaked authorization

According to researchers' analysis published November 5, 2026, failed password change requests were not terminated by the appliance. The sender is instead treated as a low-privileged user, and those privileges are sufficient to invoke the restore configuration backup feature. This is CVE-2026-116606, which is only in ESG.

Second bug: configuration values ​​are executed as commands

Uploaded backups are checksum protected, but the counter key is embedded in the firmware so fake backups can pass validation. One of the values ​​in the backup is then executed by the appliance as a system command with root privileges. Here's CVE-2026-111560. Alone, this bug requires an administrator account; after being chained to the first bug, that condition is lost.

Who is affected?

Most impacted are organizations running Barracuda ESG with admin interfaces exposed to the internet or to untrusted networks.

• Barracuda Email Security Gateway users who have not installed the early November 2026 patch.
• Users of Load Balancer ADC, Message Archiver, WAF Control Center, Web Application Firewall, and Web Security Gateway: are only affected by command injection, and in this product attackers still need an administrator account.
• Appliances with automatic patches are turned off or firmware that is several versions behind, because the patches will not apply themselves.

How serious is this loophole?

This flaw is serious because three things converge: no login required, the end result is root privileges, and the exploitation is already happening in the field.

• CVE-2026-116606 has a CVSS value of 9.3 and CVE-2026-111560 has a value of 8.6.
• Barracuda stated on November 9, 2026 that exploitation activity had been seen at a small number of organizations.
• CISA added both CVEs to the KEV catalog on November 10, 2026.
• The limiting factor is one: the attacker must be able to reach the admin interface. Appliances whose admin interface can only be accessed from the internal network are much less at risk.

Which version is safe?

A secure version is an appliance that already contains the following security patches according to the product.

How do I check if my appliance is affected?

Check two things: whether the above patch is listed in the appliance patch list, and whether the admin interface can be reached from outside. For the first, open the admin interface then look at the firmware update page and the list of installed security patches; match it to the patch name in the table.

For the second one, run the following script from a machine outside the management network, for example from a VPS. Replace HOST with the public address of the appliance and match the port list to the admin interface port you are using.

#!/usr/bin/env bash
# Jalankan dari LUAR jaringan manajemen
HOST="alamat.appliance.anda"
for p in 443 8000; do
  timeout 5 bash -c "</dev/tcp/$HOST/$p" 2>/dev/null \
    && echo "port $p TERBUKA dari sini" \
    || echo "port $p tidak terjangkau"
done

If the admin interface port is open from the internet, consider the appliance high risk until a confirmed patch is installed.

How to update safely?

The safest way is to first close access to the admin interface, then ensure the patch is installed.

Step 1: limit the admin interface

Restrict admin interface access to only trusted internal networks or via VPN, using a firewall in front of the appliance. This step breaks the main condition of the attack and can be done before scheduled maintenance.

Step 2: install patch and verify

1. Re-enable automatic patching if it was previously turned off.
2. If the patch has not arrived, install it manually according to the product and firmware version in the table.
3. Appliances that are several versions behind may need several consecutive updates; contact Barracuda support if in doubt.
4. Once complete, ensure the patch name appears in the list of installed patches.

How to detect signs of attack?

The most reasonable signs of attack are looked for in traces of abused features, namely restore backups and global configuration changes. Barracuda has not published specific indicators of compromise, so the following checks are general.

• History of restoring configuration backups that you never performed.
• Global settings changes, new admin accounts, or unknown password changes.
• Access to the admin interface from IP addresses outside your team, especially from early November 2026.
• Outbound connection from the appliance to an unusual address.

If you find signs of a burglary?

1. Disconnect the appliance from the internet without turning it off, so that evidence is not lost.
2. Save logs and configuration copies for investigation.
3. Contact Barracuda support before restoring the appliance.
4. Replace all credentials stored or passing on the appliance, including LDAP and SMTP accounts.

Frequently asked questions

Can CVE-2026-116606 be exploited without an account?

Yes. CVE-2026-116606 does not require an account, but an attacker must be able to reach the appliance admin interface.

Are patches installed automatically?

Patches come in automatically when the automatic patch feature is active. Barracuda asks customers to check themselves and install manually if the patch is not visible.

I'm using a Barracuda WAF, is it affected?

Barracuda WAF is only affected by CVE-2026-111560, and in that product attackers still need an administrator account. The BNADC-16586 patch still needs to be installed.

Is this related to the ESG attacks of 2023?

There is no evidence of a link. The 2023 flaw (CVE-2023-2868) is a different bug, and no one has yet linked this new pair of flaws to a specific perpetrator.

Is it enough to close the admin interface without a patch?

Not enough. Closing the admin interface lowers the risk drastically, but the bug remains and can be exploited by anyone on the internal network.

Also read about other flaws being exploited: Ivanti Connect Secure zero-day chain, Outlook flaw CVE-2026-124194, and OpenSSH sshole flaw.

Source

• Barracuda: Pre-Authentication Authorization Bypass and Command Injection Vulnerabilities
• CISA: Adds Six Known Exploited Vulnerabilities to Catalog (10 November 2026)
• The Hacker News: Barracuda Email Security Gateway chain enabling root access without login