Barracuda ESG CVE-2026-116606 Exploited: Config-Import Bypass Chains to Root, CISA Sets 13 November Deadline

Attackers are exploiting two flaws in Barracuda appliances that were patched on 2 November, and together they can take an Email Security Gateway (ESG) to root. Barracuda updated its advisory on 9 November to say "We have identified exploitation activity affecting a small number of organizations". CISA added both bugs to its Known Exploited Vulnerabilities catalogue on 10 November and gave US federal agencies until 13 November to act. The same batch added the Outlook flaw that leaks NTLMv2 hashes and the Chrome zero-day.

Two bugs, one chain

CVE-2026-116606 affects the ESG alone. Mandiant, which handled the disclosure, says it allows "an unauthenticated remote attacker to invoke a configuration-import function" and restore a crafted backup, rewriting the appliance's global settings. It scores CVSS 4.0 9.3.

CVE-2026-111560 is command injection through the timezone configuration field, scored CVSS 4.0 8.6. On its own it needs an administrator login. Chaining it behind the bypass removes that hurdle: Barracuda says the pair "could allow an attacker to bypass authorization controls and obtain root access to the device".

Who is attacking

Nobody has said. SecurityWeek notes that "Barracuda and CISA have not shared details on the exploitation". Previdian's sensors logged 17 attempts against CVE-2026-116606 from 15 IP addresses in three countries between 9 and 11 November. Those are attack sources, not victims.

The ESG has been hit before. In 2023 a group Mandiant tracks as UNC4841 exploited the zero-day CVE-2023-2868, and almost a third of the systems it breached belonged to government agencies. No source links this year's attacks to that group.

Affected products and patches

The ESG is fixed in 9.4.0.030. The command injection also reaches Load Balancer ADC 6.4.0, WAF 11.0.1, Web Security Gateway 16.1.100.100, Message Archiver 5.5.4.0 and WAF Control Center 2.2.1 and every earlier version.

The patches, as Barracuda's advisory lists them: ESG gets BNSF-40425 or BNSF-40430 depending on the build it runs, Load Balancer ADC and WAF get BNADC-16586, Message Archiver BNMA-32468, WAF Control Center BNWF-60060 and Web Security Gateway BNYF-24789.

The advisory tells customers to check that the latest firmware and every patch are installed, apply by hand any patch that didn't arrive automatically, switch automatic patching back on and keep administrative interfaces on trusted internal networks. For federal agencies, CISA's catalogue entries require forensic triage on top of the patch.