Barracuda ESG CVE-2026-116606 Exploited for Root Access

Attackers are exploiting two Barracuda Email Security Gateway flaws, CVE-2026-116606 and CVE-2026-111560, to get root on appliances whose admin interface they can reach. The first skips authentication to import a crafted configuration backup; the second injects OS commands through the timezone field. Barracuda patched both on November 2 and confirmed attacks on a small number of customers on November 9.

Barracuda's security advisory says that "if exploited in combination, these vulnerabilities could allow an attacker to bypass authorization controls and obtain root access to the device." On November 5 the company corrected its own rating: CVE-2026-116606 needs no authentication at all, only network access to the administrative interface. Mandiant disclosed both bugs, according to its advisory for CVE-2026-116606 referenced on the NVD entry.

NVD scores CVE-2026-116606 at 9.3 (Critical, CWE-288 authentication bypass): an unauthenticated attacker can call a configuration-import function on ESG versions before 9.4.0.030 and restore a crafted backup. CVE-2026-111560 scores 8.6 (High, CWE-78 OS command injection): shell characters in the timezone setting run as root when that value is processed. On its own the second bug needs an admin; chained after the first, it does not.

Which Barracuda products are affected?

Only ESG is affected by both bugs, the combination that leads to root, and it is the product Barracuda says is under attack. Patches install automatically unless an admin turned auto-patching off. If a device is several firmware versions behind, Barracuda says it may need more than one update.

Are the Barracuda ESG flaws being exploited?

Yes, against a small number of organizations, according to Barracuda's November 9 update reported by BleepingComputer. Neither CVE is in CISA's Known Exploited Vulnerabilities catalog as of November 10. EPSS gives CVE-2026-116606 a 1.6% exploitation probability (76th percentile), a score that has not yet caught up with the vendor's own confirmation. Barracuda ESG has been hit before: the UNC4841 group exploited CVE-2023-2868 as a zero-day for at least seven months in 2022 and 2023, and Mandiant found almost a third of the breached systems belonged to government agencies.

What should Barracuda ESG admins do now?

Confirm the patch is installed on every ESG, and check that auto-patching is on. Take the admin interface off the internet: Barracuda says organizations whose admin UI is not publicly reachable are less exposed, and recommends limiting it to trusted internal networks. Then review each appliance for configuration you did not make, such as changed relay settings, new accounts or an odd timezone value, since a crafted backup import changes global configuration. Our advice: if an exposed ESG went unpatched after November 2, treat it as possibly compromised and contact Barracuda support.

Our read

The exploitable condition here is an admin panel reachable from the internet, which is a classic finding, not a new one. Email gateways sit in front of every inbox, and attackers have shown twice in three years that they are worth the effort. Inventory which appliance admin interfaces are exposed, not just which firmware they run. See how this mirrors the Cisco Secure Email Gateway exploitation and the FortiMail zero-day, and why EPSS and KEV lag fresh exploitation. Nexus Void runs VAPT on web apps, APIs and mobile apps, including exposed admin interfaces.

Reporting by BleepingComputer; details per the Barracuda advisory; CVSS per NVD, EPSS per FIRST.