CVE-2026-116606 and CVE-2026-111560: Barracuda ESG Authentication Bypass Chains to Root Command Injection

Background

Barracuda’s Email Security Gateway (ESG) is a mail-filtering appliance (our summary). Barracuda published an advisory on 2 November 2026 covering two vulnerabilities: CVE-2026-116606, an authorization bypass in the ESG, and CVE-2026-111560, an OS command injection that affects the ESG and five other products. This article covers both CVEs; neither has a separate Vuln Brief article. Mandiant, as CNA, published a disclosure for each (MNDT-2026-0042 and MNDT-2026-0041).

Barracuda says that exploited in combination, the flaws “could allow an attacker to bypass authorization controls and obtain root access to the device”. CISA added both CVEs to the KEV catalog on 10 November 2026 and describes each as chainable with the other.

Technical Mechanism

CVE-2026-116606 (CWE-288, authentication bypass using an alternate path or channel). Per Mandiant, an attacker invokes a configuration-import function without authenticating and restores a crafted, compatible backup archive. That modifies the appliance’s global configuration. Affects ESG only.

CVE-2026-111560 (CWE-78, OS command injection). Shell metacharacters in the timezone configuration field are not neutralized. A crafted timezone value runs OS commands as root when it is later processed. It needs administrator privileges.

The chain. The bypass reaches the configuration-restore path without credentials, and the restored configuration can carry the crafted timezone value, which the command injection then executes. CISA’s KEV text states the two can be chained. watchTowr’s analysis of the patch diff describes the same flow: an unauthenticated request to /cgi-mod/index.cgi reaching the restore code, and the restore finalization step using system_timezone in a shell command. Barracuda and Mandiant do not publish the payload flow.

Scores and a source conflict. Both are CVSS 4.0 scores from the CNA, Mandiant: CVE-2026-116606 9.3 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H), CVE-2026-111560 8.6 (AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H). Barracuda’s advisory lists the same numbers. On authentication for CVE-2026-116606, Mandiant and CISA call it unauthenticated. Barracuda’s 5 November update changed the field to “No (Administrative UI Access Required)”: no credentials are needed, but the attacker must be able to reach the administrative interface. Both statements are consistent with a CVSS PR:N score.

Real-World Exploitation Evidence

• Barracuda (advisory updated 9 November 2026, 9:00pm EST): “exploitation activity that has been observed affecting a small number of organizations.” The advisory gives no counts, dates, actor or indicators.
• CISA KEV: both CVEs added 10 November 2026, due date 13 November 2026, both flagged for forensic triage (forensicTriage: Yes). knownRansomwareCampaignUse is “Unknown” for both.
• Attribution: no evidence found as of 2026-11-11 in the Barracuda advisory, the Mandiant disclosures or the KEV entries of a named threat actor or campaign.
• CISA-ADP SSVC (CVE record): both CVEs carry “Exploitation: active”; CVE-2026-116606 is Automatable: yes and CVE-2026-111560 Automatable: no; Technical Impact is total for both. The SSVC timestamp is 2 November 2026, a record timestamp that predates Barracuda’s 9 November statement; it does not show when exploitation began.
• Public exploit details and tooling: watchTowr Labs published a technical analysis on 5 November 2026 (“Barracuda Networks is your new best friend”) that includes a full request sequence and backup-construction code, and a GitHub repository, created 3 November 2026, labelled by its author a detection artifact generator for the ESG chain (the label does not make it safe to run; it sends the supplied command to the target). Its README shows it uploading a crafted backup and running a supplied command (for example touch /tmp/test) on the target. watchTowr’s patch-diff analysis reports that the patched code now requires system_timezone to resolve to a file under /usr/share/zoneinfo/. We did not run the tool. A GitHub repository search for each CVE ID on 2026-11-11 returned only that repository.
• Dates: Mandiant dates the reports to 15 October (CVE-2026-111560) and 22 October (CVE-2026-116606), with CVE publication on 2 November. When exploitation began is not stated.

Impact Assessment

A successful chain gives root on a mail gateway that handles an organization’s inbound and outbound email. Barracuda’s own wording is root access to the device; what an attacker then does (mail interception, credential capture, pivoting) is not documented in the sources and depends on the deployment.

Barracuda stresses that administrative interface exposure is the precondition: “Organizations whose administrative interfaces are not publicly accessible from the internet are less exposed to this attack path”. CVE-2026-111560 alone requires an administrator, so on the five non-ESG products it appears to be an admin-to-root escalation rather than a remote entry point (our inference from the advisory’s “Authentication Required: Yes (Administrative Access)”). The 8.6 score still applies at network attack vector.

Affected Versions

Version ranges in the Mandiant/CNA records: CVE-2026-116606, ESG earlier than 9.4.0.030. CVE-2026-111560: ESG up to 9.4.0.27, ADC up to 6.4.0, WAF up to 11.0.1, WSG up to 16.1.100.100, BMA up to 5.5.4.0, WCC up to 2.2.1. The advisory describes patches rather than fixed version numbers for most products.

Remediation Steps

1. Confirm each appliance is on the latest firmware and has received the patch in the table. Barracuda says the device shows the latest available firmware version, and devices several versions behind may need more than one update.
2. Apply any missing patch manually if automatic patching is off, and turn automatic patching on. Barracuda points to its Campus documentation for the procedure.
3. Restrict the administrative interface to trusted internal networks, as Barracuda recommends.
4. For U.S. federal agencies, the KEV due date is 13 November 2026. CISA flags forensic triage for both CVEs. Our recommendation: assume compromise is possible on any exposed unpatched appliance and do not rely on patching alone.

Detection Guidance

The Barracuda advisory lists no indicators as of 2026-11-11. Our suggestions, not vendor guidance:

• Review administrative-interface access logs for requests from unexpected addresses, especially calls to configuration import or restore functions without a prior login.
• Compare the current appliance configuration and timezone setting against a known-good backup; an unexpected timezone string containing shell metacharacters is suspicious.
• Check for unexpected configuration restores or changes, and for new accounts, scheduled jobs or outbound connections from the appliance.
• Contact Barracuda Support ([email protected]) if you suspect compromise.

Timeline

References

• Barracuda advisory: Pre-Authentication Authorization Bypass and Command Injection Vulnerabilities
• Mandiant MNDT-2026-0042 (CVE-2026-116606)
• Mandiant MNDT-2026-0041 (CVE-2026-111560)
• CVE record: CVE-2026-116606
• CVE record: CVE-2026-111560
• watchTowr Labs analysis (2026-11-05)
• watchTowr GitHub repository
• CISA Known Exploited Vulnerabilities Catalog