Are your Barracuda appliances exposed to CVE-2026-116606?

CVE-2026-116606 is an authorisation bypass in Barracuda Email Security Gateway (ESG) that needs no login. On 5 November 2026 Barracuda changed its Authentication Required field for this CVE to No (Administrative UI Access Required): no login is needed, but the attacker must be able to reach the Admin UI. The CVE record says an attacker can invoke a configuration import function and restore a crafted backup, changing the appliance's global configuration. It is scored CVSS 4.0 9.3 and affects ESG only.

CVE-2026-111560 is OS command injection through the timezone configuration field. Shell characters in that field are not filtered, so an administrator can run commands as root. Barracuda lists it as Authentication Required: Yes (Administrative Access). Some news reports describe it as usable without authentication; we follow Barracuda. It is scored CVSS 4.0 8.6 and sits in shared Barracuda code, so it affects ESG, Load Balancer ADC, WAF, Web Security Gateway, Message Archiver and WAF Control Center.

CISA's KEV descriptions say each vulnerability can be chained with the other; that is CISA describing what is possible, not Barracuda saying the attacks used both. Barracuda's own wording is still conditional: if exploited in combination, these vulnerabilities could allow an attacker to bypass authorization controls and obtain root access to the device. Barracuda has not said the observed activity used both CVEs or chained them. Barracuda also says successful exploitation needs access to the administrative interface, so appliances with admin pages on the internet are most at risk. Barracuda's Trust Center rates both flaws High.

CISA added both CVE-2026-116606 and CVE-2026-111560 to its Known Exploited Vulnerabilities catalogue on 10 November 2026. The KEV catalogue version 2026.11.10 was released at 19:03 GMT that day (1,779 entries). KEV records a date added of 10 November 2026 for both CVEs, not a time they were inserted. CISA's due date is 13 November 2026; that due date binds US federal agencies. Patch now regardless. CISA also requires forensic triage, and says to collect evidence before changing systems where possible. CISA's KEV descriptions say each vulnerability can be chained with the other; that is CISA describing what is possible, not Barracuda saying the attacks used both. Barracuda updated its Trust Center advisory on 9 November 2026 at 9:00pm EST (02:00 GMT on 10 November) to say: We have identified exploitation activity affecting a small number of organizations. Barracuda does not name which CVE was exploited and has not said the observed activity used both CVEs or chained them. Barracuda's own wording is still conditional: if exploited in combination, these vulnerabilities could allow an attacker to bypass authorization controls and obtain root access to the device. Known ransomware campaign use in KEV is Unknown. Barracuda still rates both flaws High. Neither Barracuda nor CISA has published indicators of compromise. We re-checked NVD at 19:15 GMT on 10 November 2026: both records are still Awaiting Analysis (last modified 3 November 2026). We re-opened the official CVE records at the same time; both were last updated on 3 November 2026, and the CISA SSVC field in those records (dated 2 November 2026) still says Exploitation none, which is now out of date. KEV lists Load Balancer and ADC as two products; Barracuda lists one (Load Balancer ADC). We follow Barracuda (six products). Separately, the Canadian Centre for Cyber Security updated its advisory AV26-1112 on 9 November to say that open source reporting indicates CVE-2026-116606 is exploited in the wild; that is the Cyber Centre's statement, not Barracuda's.

Barracuda's Campus ESG article says to update to firmware 9.4.0.029 or later under Advanced > Firmware Update. The CVE record says versions earlier than 9.4.0.030 are affected. We follow Barracuda (9.4.0.029 or later). The Trust Center splits patch IDs at 9.4.017 (BNSF-40425 for 9.4.017 and later, BNSF-40430 before that) and the Campus ESG article writes 9.4.0.17; we treat 9.4.017 and 9.4.0.17 as the same build. That figure is the patch-ID split, not the fixed-in firmware version, and we do not treat it as equal to 9.4.0.029. Check the version your appliance reports after updating, and move to the latest firmware it offers if you want no doubt.

You cannot jump straight to 9.4.0.029. Barracuda says appliances below 9.1 need two update steps. Update once, check the reported version, update again, then confirm it reports 9.4.0.029 or later. Reboot if prompted and check the version again.

For ADC, WAF, Web Security Gateway, Message Archiver and WAF Control Center, Barracuda fixes CVE-2026-111560 with a security patch and gives no fixed firmware number. The patch does not change the firmware number, so the version alone cannot prove you are safe. Confirm in each appliance's web interface that the patch ID is applied.

Take it off the internet or limit it to management IPs or a VPN, update, then rotate admin credentials and API keys. Then hunt for unexpected timezone changes, configuration restores, unknown admin sessions, odd processes or outbound connections and new files or cron jobs from before you updated.

No. The patch stops new exploitation but leaves any backdoor, changed configuration, new admin account or cron job already in place. In 2023 updating ESG did not remove attackers who were already in. If you suspect compromise, our advice is to treat the device as compromised: isolate it, keep its logs, contact Barracuda support and rebuild if needed.

Barracuda says that if a patch has not been automatically applied, customers should apply the appropriate patch manually as soon as possible, and that customers who turned off automatic patches should set devices to receive them automatically again. Barracuda also says a device several firmware versions out of date may need more than one update, and that Barracuda Support (support@barracuda.com) can help verify firmware or apply the patch.

Export an inventory of every Barracuda appliance across your clients as name, product and version, and run the free checker against it. Use the exit codes to flag LIKELY VULNERABLE and UNKNOWN appliances, take their admin interfaces off the internet first, and confirm the patch in each web interface.