Barracuda says attackers are now exploiting the Email Security Gateway auth bypass and root command injection it patched on Nov 2 (CVE-2026-116606, CVE-2026-111560)
- Exposed: ESG appliances whose Admin UI is reachable by the attacker. CVE-2026-116606 (CVSS 4.0 9.3, ESG only) lets an unauthenticated request run admin-only handlers after a deliberately failed password change; CVE-2026-111560 (8.6) is a root command injection through the restored
system_timezonesetting and also affects Load Balancer ADC, Message Archiver, WAF, WAF Control Center and Web Security Gateway. - Fix: Barracuda patches BNSF-40425 (ESG 9.4.017 and later) and BNSF-40430 (older ESG), plus BNADC-16586, BNMA-32468, BNWF-60060 and BNYF-24789 for the other products. watchTowr tested 9.4.0.029 as fixed; the Mandiant-assigned CVE record and the Cyber Centre list ESG before 9.4.0.030 as affected, so go to the latest firmware rather than stopping at .029.
- If auto-patching was off or the box is several firmware versions behind, Barracuda says you may need more than one update; check the version the device actually reports.
- Barracuda hasn't said who is exploiting it or how it found the activity. Treat any ESG with an internet-facing Admin UI that was unpatched after Nov 5 as possibly compromised (see the hunt item).
Sources: Barracuda Trust Center: Pre-Authentication Authorization Bypass and Command Injection Vulnerabilities (updated Nov 9, 2026) · Canadian Centre for Cyber Security: Barracuda Networks security advisory AV26-1112, Update 1 (Nov 9, 2026) · Mandiant MNDT-2026-0042 (CVE-2026-116606) · watchTowr Labs technical analysis (Nov 5, 2026)