---
title: Barracuda says attackers are now exploiting the Email Security Gateway auth bypass and root command injection it patched on Nov 2 (CVE-2026-116606, CVE-2026-111560) | ctxsec
url: https://ctxsec.com/items/barracuda-esg-cve-2026-116606-111560-exploited-small-number-of-orgs-nov-9
description: "Barracuda updated its advisory Monday night to say it has seen exploitation affecting a small number of organizations. Chained, the two bugs give an unauthenticated attacker root on an ESG appliance, provided they can reach its administrative web interface. watchTowr published a full technical write-up and a working detection script on Nov 5, and Canada's Cyber Centre now says CVE-2026-116606 is exploited in the wild. Patches have been out since Nov 2; Barracuda says to confirm they were actually applied and to keep the admin UI off the internet."
status: "official (Barracuda Trust Center advisory, updated Nov 9, 2026, 9:00 PM EST: \"We have identified exploitation activity affecting a small number of organizations\"; Canadian Cyber Centre AV26-1112 Update 1, Nov 9); not in CISA KEV as of catalog 2026.11.09"
published: 2026-11-10
---

> Barracuda updated its advisory Monday night to say it has seen exploitation affecting a small number of organizations. Chained, the two bugs give an unauthenticated attacker root on an ESG appliance, provided they can reach its administrative web interface. watchTowr published a full technical write-up and a working detection script on Nov 5, and Canada's Cyber Centre now says CVE-2026-116606 is exploited in the wild. Patches have been out since Nov 2; Barracuda says to confirm they were actually applied and to keep the admin UI off the internet.

[← Cybersecurity News](/news) · [markdown](/items/barracuda-esg-cve-2026-116606-111560-exploited-small-number-of-orgs-nov-9.md)

official (Barracuda Trust Center advisory, updated Nov 9, 2026, 9:00 PM EST: "We have identified exploitation activity affecting a small number of organizations"; Canadian Cyber Centre AV26-1112 Update 1, Nov 9); not in CISA KEV as of catalog 2026.11.09

2026-11-10

### Barracuda says attackers are now exploiting the Email Security Gateway auth bypass and root command injection it patched on Nov 2 (CVE-2026-116606, CVE-2026-111560)

- **Exposed:** ESG appliances whose Admin UI is reachable by the attacker. CVE-2026-116606 (CVSS 4.0 9.3, ESG only) lets an unauthenticated request run admin-only handlers after a deliberately failed password change; CVE-2026-111560 (8.6) is a root command injection through the restored `system_timezone` setting and also affects Load Balancer ADC, Message Archiver, WAF, WAF Control Center and Web Security Gateway.
- **Fix:** Barracuda patches BNSF-40425 (ESG 9.4.017 and later) and BNSF-40430 (older ESG), plus BNADC-16586, BNMA-32468, BNWF-60060 and BNYF-24789 for the other products. watchTowr tested 9.4.0.029 as fixed; the Mandiant-assigned CVE record and the Cyber Centre list ESG before 9.4.0.030 as affected, so go to the latest firmware rather than stopping at .029.
- **If auto-patching was off** or the box is several firmware versions behind, Barracuda says you may need more than one update; check the version the device actually reports.
- Barracuda hasn't said who is exploiting it or how it found the activity. Treat any ESG with an internet-facing Admin UI that was unpatched after Nov 5 as possibly compromised (see the hunt item).

Sources: [Barracuda Trust Center: Pre-Authentication Authorization Bypass and Command Injection Vulnerabilities (updated Nov 9, 2026)](https://trust.barracuda.com/security/pre-authentication-authorization-bypass-command-injection) · [Canadian Centre for Cyber Security: Barracuda Networks security advisory AV26-1112, Update 1 (Nov 9, 2026)](https://www.cyber.gc.ca/en/alerts-advisories/barracuda-networks-security-advisory-av26-1112) · [Mandiant MNDT-2026-0042 (CVE-2026-116606)](https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2026/MNDT-2026-0042.md) · [watchTowr Labs technical analysis (Nov 5, 2026)](https://labs.watchtowr.com/barracuda-networks-is-your-new-best-friend-barracuda-email-security-gateway-pre-auth-remote-root-rce-cve-2026-116606-cve-2026-111560/)