Are your Barracuda appliances exposed to CVE-2026-116606?
Barracuda disclosed two flaws on 2 November 2026. CVE-2026-116606 lets an attacker with no login bypass authorisation on Email Security Gateway (ESG). CVE-2026-111560 is command injection that runs as root on ESG and five other products. Chained on ESG, they give root. Update ESG to 9.4.0.029 or later and confirm the patch on the rest.
Not in CISA KEV, no exploitation reported
Neither CVE is in CISA's Known Exploited Vulnerabilities catalogue (checked 3 November 2026), Barracuda does not report exploitation and no indicators of compromise have been published. ESG was mass-exploited in 2023. Do not wait: update now and take admin interfaces off the internet.
By Simon Phillips, CTO. Reviewed by Oliver Legg, Head of SOC and IR. Last updated 3 November 2026, 15:47 GMT.
At a Glance
Based on Barracuda, NVD and CISA as of 3 November 2026. Last updated 3 November 2026, 15:47 GMT.
CVSS 4.0 9.3 and 8.6
CVE-2026-116606 scores 9.3 and CVE-2026-111560 scores 8.6. Barracuda's Trust Center rates both High. NVD lists both as Awaiting Analysis.
Not in KEV
No exploitation reported by Barracuda and no published indicators of compromise.
ESG plus five products
ESG has both flaws. ADC, WAF, Web Security Gateway, Message Archiver and WAF Control Center have CVE-2026-111560.
ESG 9.4.0.029, patch IDs
ESG firmware 9.4.0.029 or later. The other products get a security patch with no new firmware number.
Barracuda discloses CVE-2026-116606 and CVE-2026-111560, found by security researchers, and releases security patches.
The CVE records are published. NVD lists both as Awaiting Analysis.
The flaws are reported publicly. Neither is in CISA KEV and no exploitation is reported.
Update, confirm the patch on each appliance and take admin interfaces off the internet.
Affected and fixed versions
| Product | Affected | Fix |
|---|---|---|
| Email Security Gateway (ESG) | Both CVEs. Barracuda: all versions. CVE record: earlier than 9.4.0.030 | Firmware 9.4.0.029 or later (Advanced > Firmware Update), or patch BNSF-40425 (9.4.0.17 and later) or BNSF-40430 (below 9.4.0.17). Below 9.1, update in two steps. |
| Load Balancer ADC | CVE-2026-111560, up to 6.4.0 | Patch BNADC-16586 and the latest firmware. Confirm in the web interface that the security patch is applied. The patch does not change the firmware number. |
| Web Application Firewall (WAF) | CVE-2026-111560, up to 11.0.1 | Patch BNADC-16586 (as listed by Barracuda) and the latest firmware. Confirm in the web interface that the security patch is applied. The patch does not change the firmware number. |
| Web Security Gateway (WSG) | CVE-2026-111560, up to 16.1.100.100 | Patch BNYF-24789 and the latest firmware. Confirm in the web interface that the security patch is applied. The patch does not change the firmware number. |
| Message Archiver (BMA) | CVE-2026-111560, up to 5.5.4.0 | Patch BNMA-32468 and the latest firmware. Confirm in the web interface that the security patch is applied. The patch does not change the firmware number. |
| WAF Control Center (WCC) | CVE-2026-111560, up to 2.2.1 | Patch BNWF-60060 and the latest firmware. Confirm in the web interface that the security patch is applied. The patch does not change the firmware number. |
Affected versions for the non-ESG products come from the CVE records, which list them as "up to and including". Barracuda pushes security patches automatically unless auto-updates are turned off.
The ESG version mismatch
Barracuda's ESG article says to update to 9.4.0.029 and check that the appliance reports 9.4.0.029 or later. The CVE record for CVE-2026-116606 says versions earlier than 9.4.0.030 are affected. We follow Barracuda, but confirm the version each appliance reports after updating, and move to the latest firmware it offers if you want no doubt.
Confirm the patch on every product except ESG
On Load Balancer ADC, WAF, Web Security Gateway, Message Archiver and WAF Control Center, the security patch does not change the firmware number, and Barracuda publishes no fixed firmware version. Checking the version is not enough. Confirm in each appliance's web interface that the patch ID in the table is applied.
What to Do in the Next 24 Hours
Proactive on the left. Reactive on the right. Tick both tracks.
Update and restrict
- Inventory every Barracuda appliance, including virtual and cloud ones.
- Update ESG to 9.4.0.029 or later, and apply the patch on the others.
- Confirm the firmware, and on non-ESG products the patch ID, in the web interface.
- Take admin interfaces off the internet, or limit them to management IPs or a VPN, and rotate admin credentials.
Hunt and contain
- Look for unexpected timezone configuration changes.
- Look for unknown admin sessions and configuration restores you did not make.
- Check for odd processes, outbound connections, new files or cron jobs.
- If you find any, isolate the appliance, keep its logs and contact Barracuda support.
Proactive: Check Exposure and Update
Update every appliance, confirm the fix is in place and keep admin interfaces off the open internet.
Inventory every Barracuda appliance
List every ESG, Load Balancer ADC, WAF, Web Security Gateway, Message Archiver and WAF Control Center, including virtual and cloud appliances, from your RMM, Barracuda Cloud Control and firewall NAT rules. MSPs should do this across every client. Export it as name, product and version and run the free checkers below.
Update ESG to 9.4.0.029 or later
Sign in to the web interface as admin, go to Advanced > Firmware Update, read the current installed version and update to 9.4.0.029. Below 9.1 you must update in two steps. Reboot if prompted. See Barracuda's ESG guidance.
Apply the patch on the other products
Make sure auto-updates are on and the security patch for each product (listed in the table above) is applied, along with the latest firmware. See Barracuda's security update notice.
Confirm the firmware and the patch
After updating, check the firmware version each ESG reports. On every other product the patch does not change the firmware number, so confirm in the appliance's web interface that the patch is applied. Do not rely on the version alone.
Take admin interfaces off the internet
Barracuda says exploitation needs access to the administrative interface. Remove internet access to it, or limit it to management IPs or a VPN. Use KQL Q4 and the inbound Sigma rule to check nothing from the internet still reaches the admin ports.
Rotate admin credentials
Change admin passwords and API keys on every affected appliance, and review the admin account list for accounts you do not recognise.
Free Detection Pack
Built by the CybaVerse threat hunt team for businesses, internal IT teams and MSPs. Check each appliance's version and hunt for signs of exploitation. Everything is read-only.
check-barracuda.sh
Compares the product and firmware version you give it, or a CSV inventory, against the affected ranges, and counts timezone and admin login lines in an exported syslog file.
bash check-barracuda.sh --product ESG --version 9.4.0.027
# Whole estate, from an RMM export (name,product,version)
bash check-barracuda.sh --csv inventory.csv \
--syslog exported-syslog.logCheck-Barracuda.ps1
The same checks in PowerShell 7, with the same output and exit codes. It also runs under PowerShell on Linux.
pwsh -File Check-Barracuda.ps1 -Product WAF -Version 11.0.1
pwsh -File Check-Barracuda.ps1 -Csv inventory.csv `
-Syslog exported-syslog.logKQL and Sigma
7 KQL queries for Microsoft Sentinel and Defender XDR: timezone changes, admin logins from new IPs, failed then successful logins, internet traffic to admin ports, new outbound connections, managed hosts reaching admin pages and a device inventory. 5 Sigma rules cover the same ground for other SIEM platforms.
Verdicts
- PATCHEDESG on 9.4.0.029 or later.
- LIKELY VULNERABLEESG below 9.4.0.029 (flagged for a two-step update below 9.1), or another product at or below the affected version in the CVE record. The security patch may already be applied without a firmware change, so confirm in the web interface.
- UNKNOWNAnother product above the affected range, as Barracuda gives no fixed firmware number to check against, or an unknown product or version.
Exit codes
| Code | Meaning |
|---|---|
| 0 | All PATCHED |
| 1 | Any LIKELY VULNERABLE |
| 2 | Any UNKNOWN, none vulnerable |
| 3 | Error, such as no inputs or an unreadable file |
MSPs can use the exit code in RMM or scheduled jobs to flag appliances at scale. Both checkers also print the CISA KEV status.
Know the limits
- Both checkers are read-only and offline. They only compare version strings, a CSV and an exported syslog file you give them, never contact an appliance or its admin interface and send no network traffic.
- On every product except ESG, the patch does not change the firmware number. A version check cannot show the patch is applied, so confirm it in the appliance's web interface.
- None of the KQL has been run against a live tenant. It is syntax-reviewed only. Log fields and keywords marked UNVERIFIED FIELD or UNVERIFIED are assumptions, because Barracuda has not published log strings for these CVEs and syslog layouts differ by product. Set the admin ports to your own.
- The Sigma rules convert to Kusto without a pipeline. Add the table mapping (CommonSecurityLog or Syslog) yourself. A syslog line count from the checker is not evidence of compromise.
- The pack contains no indicators of compromise, because none have been published. IPs in the queries are documentation placeholders.
Reactive: How to Hunt
No indicators of compromise have been published, so hunt for behaviour. Go back to before 2 November 2026 for every appliance whose admin interface was reachable from the internet. CybaOps can run these hunts across your estate or your clients'.
Unexpected timezone configuration changes
Look for timezone changes nobody made, especially values with shell characters such as ;, |, $( or backticks (KQL Q1 and the Sigma timezone rules).
Unknown admin sessions
Look for admin logins from new or external IPs, and failed logins followed by a success (KQL Q2 and Q3).
Configuration restores you did not make
CVE-2026-116606 abuses the configuration import function, so check for ESG configuration imports or restores that were not part of planned work.
Odd processes or outbound connections
Look for new outbound connections from the appliance to hosts it does not normally talk to (KQL Q5 and the outbound Sigma rule).
New files or cron jobs
Ask Barracuda support to check the appliance for new files, scheduled tasks or cron jobs, as these are not visible from the web interface.
If you find something
- Isolate the appliance by restricting network access. Keep it powered and do not wipe it.
- Keep the evidence: export syslog and the configuration.
- Contact Barracuda Technical Support.
- Rebuild or replace the appliance if compromise is confirmed or cannot be ruled out.
- Rotate every credential the appliance held or saw, including admin, LDAP or Active Directory bind, SMTP relay and API credentials. UK organisations can also report to the NCSC.
Patched does not mean clean
The patch stops new exploitation. It does not remove a backdoor, a changed configuration, a new admin account or a cron job planted before you updated. In 2023, updating ESG did not remove attackers who were already in. Do not rely on the patch alone.
Barracuda CVE-2026-116606 and CVE-2026-111560 FAQ
Short answers based on Barracuda, NVD and CISA as of 3 November 2026.
What is CVE-2026-116606?
CVE-2026-116606 is an authorisation bypass in Barracuda Email Security Gateway (ESG) that needs no login. The CVE record says an attacker can invoke a configuration import function and restore a crafted backup, changing the appliance's global configuration. It is scored CVSS 4.0 9.3 and affects ESG only.
What is CVE-2026-111560?
CVE-2026-111560 is OS command injection through the timezone configuration field. Shell characters in that field are not filtered, so an administrator can run commands as root. It is scored CVSS 4.0 8.6 and sits in shared Barracuda code, so it affects ESG, Load Balancer ADC, WAF, Web Security Gateway, Message Archiver and WAF Control Center.
How serious is it when they are chained?
On ESG, an attacker can use CVE-2026-116606 to get past the login and CVE-2026-111560 to run commands as root, taking over the appliance. Barracuda says exploitation needs access to the administrative interface, so appliances with admin pages on the internet are most at risk. Barracuda's Trust Center rates both flaws High.
Is either CVE being exploited or in CISA KEV?
Not as far as is known. Neither CVE was in CISA's Known Exploited Vulnerabilities catalogue when we checked on 3 November 2026, Barracuda does not report exploitation and no indicators of compromise have been published. ESG was mass-exploited in 2023, so expect attackers to look at this quickly.
Which ESG version fixes it?
Barracuda says to update ESG to firmware 9.4.0.029 or later under Advanced > Firmware Update. The CVE record says versions earlier than 9.4.0.030 are affected, so the two sources disagree by one build. Check the version your appliance reports after updating, and move to the latest firmware it offers if you want no doubt.
Our ESG is older than 9.1. What changes?
You cannot jump straight to 9.4.0.029. Barracuda says appliances below 9.1 need two update steps. Update once, check the reported version, update again, then confirm it reports 9.4.0.029 or later. Reboot if prompted and check the version again.
How do we know the other products are fixed?
For ADC, WAF, Web Security Gateway, Message Archiver and WAF Control Center, Barracuda fixes CVE-2026-111560 with a security patch and gives no fixed firmware number. The patch does not change the firmware number, so the version alone cannot prove you are safe. Confirm in each appliance's web interface that the patch ID is applied.
What should we do if the admin interface was on the internet?
Take it off the internet or limit it to management IPs or a VPN, update, then rotate admin credentials and API keys. Then hunt for unexpected timezone changes, configuration restores, unknown admin sessions, odd processes or outbound connections and new files or cron jobs from before you updated.
Does the patch remove an attacker who is already in?
No. The patch stops new exploitation but leaves any backdoor, changed configuration, new admin account or cron job already in place. In 2023 updating ESG did not remove attackers who were already in. If you suspect compromise, isolate the appliance, keep its logs, contact Barracuda support and rebuild if needed.
We are an MSP. Where do we start?
Export an inventory of every Barracuda appliance across your clients as name, product and version, and run the free checker against it. Use the exit codes to flag LIKELY VULNERABLE and UNKNOWN appliances, take their admin interfaces off the internet first, and confirm the patch in each web interface.
Protect Your Edge, and Your Clients'
CybaOps monitors your servers, endpoints, network appliances and cloud workloads, whether that's your own business or your clients'. UK-based analysts monitor alerts 24/7, run these threat hunts and act on pre-approved response actions, and CybaOps drives remediation through to a verified fix, so proactive checks and reactive response happen in one place.
Sources
- Barracuda Campus: Security Updates Available for Certain Barracuda Products
- Barracuda Campus: Pre-Authentication Authorization Bypass and Command Injection Vulnerabilities (Email Security Gateway)
- NVD: CVE-2026-111560
- BleepingComputer: Barracuda warns of critical flaws allowing root access to devices
Related threat guides: HPE Aruba AOS flaws and Arista VeloCloud CVE-2026-114625. All threat guides.