CVE-2026-116606 & CVE-2026-111560 (CVSS 9.3+8.6): Pre-Auth Root Exploit Chain on Barracuda ESG — Patch Six Products Now

Your email security gateway — the appliance you trust to keep malware and phishing out of every inbox in the organisation — has just become a potential root shell for any unauthenticated attacker on the internet who can reach its admin port. That is the stark reality of CVE-2026-116606 and CVE-2026-111560, two newly disclosed vulnerabilities in Barracuda Email Security Gateway (ESG) and five related products. Chained together, they hand a remote attacker full root access — with no credentials required. If your Barracuda appliances have not been patched to firmware 9.4.0.030 or later, they are exposed right now.

What Just Happened — The Two-CVE Chain Explained

Barracuda disclosed both vulnerabilities on 2 November 2026, alongside patches for all affected product lines. Within days, the security research firm watchTowr published a detailed write-up demonstrating a fully weaponised, unauthenticated root exploit chain — confirming this is not a theoretical risk.

Step 1 — Break the door open (CVE-2026-116606, CVSS 9.3). The ESG admin interface exposes a configuration-backup import function. Normally this requires a valid admin session. The vulnerability is that the integrity check on the backup archive relies on a hard-coded secret embedded in the appliance firmware. Because the secret never changes, any attacker who reads the firmware — or who simply follows watchTowr’s public write-up — can forge a valid backup checksum and submit a crafted archive to the import endpoint without ever authenticating. The appliance happily accepts it and overwrites global settings with attacker-controlled values.

Step 2 — Escalate to root (CVE-2026-111560, CVSS 8.6). Once appliance settings are under the attacker’s control, CVE-2026-111560 comes into play. This is an OS command injection flaw in a code module shared by six Barracuda products. The injected commands run as the root user — the highest privilege level on a Linux-based appliance. An attacker can install a persistent backdoor, exfiltrate all email, intercept TLS-decrypted traffic, pivot deeper into the internal network, or use the appliance as a launch-pad for further attacks.

The practical outcome, as watchTowr demonstrated: a pre-authentication, unauthenticated, remote root shell on a device that sits at the perimeter of thousands of corporate networks. The only prerequisite is network reachability to the management interface — no credentials, no prior access, no inside knowledge.

Scope: Six Barracuda Products Are Affected

CVE-2026-116606 affects only the Email Security Gateway. CVE-2026-111560, however, affects the shared command-dispatch module present in a much wider product family:

Product	CVE-2026-116606	CVE-2026-111560	Hotfix / Patch
Email Security Gateway (ESG)	✅ Affected	✅ Affected	BNSF-40425 (≥9.4.017) / BNSF-40430 (<9.4.017) → build 9.4.0.030
Load Balancer ADC / WAF	—	✅ Affected	BNADC-16586
Message Archiver	—	✅ Affected	BNMA-32468
WAF Control Center	—	✅ Affected	BNWF-60060
Web Security Gateway	—	✅ Affected	BNYF-24789

Source: Barracuda official advisory and BleepingComputer.

Why This Is a High-Priority Threat Despite No Confirmed Exploitation

The absence of a CISA KEV entry does not mean you have weeks to plan. Consider the threat model:

1. A working exploit is public. watchTowr’s write-up and the Security Affairs and The Hacker News coverage contain enough technical detail for a competent threat actor to weaponise the chain within hours. Mass-scanning is likely already underway on port 8000 (the typical ESG admin port).
2. Email gateways are prime espionage targets. Nation-state actors — most famously China-linked UNC4841, which exploited CVE-2023-2868 in Barracuda ESG — specifically seek persistent access to email appliances because they intercept both inbound and outbound mail and sit inside the network perimeter. The FBI’s unprecedented advice to replace rather than patch all ESG appliances in 2023 illustrated how devastating that campaign was.
3. Admin interfaces are frequently internet-exposed. In the author’s experience consulting with Indian enterprises, management ports on perimeter appliances are surprisingly often reachable from the public internet — either by deliberate design for remote management or through misconfigured firewall rules. If that describes your environment, your exposure window is effectively zero.
4. Exploitation requires only network reach — no credentials. A pre-auth network appliance exploit is categorically worse than an authenticated one; you cannot compensate with password hygiene or MFA.

What You Should Do — Sanjay’s Defensive Action Plan

This is a “drop what you are doing” moment for any organisation running Barracuda appliances. Here is a prioritised response plan:

Immediate (within 24 hours)

• Apply the patch today. Log in to Barracuda Energize Updates and push the relevant hotfix for every affected appliance. For ESG, the target build is 9.4.0.030 (BNSF-40425 for appliances on 9.4.017+ or BNSF-40430 for older builds). Do not wait for a scheduled maintenance window.
• Restrict admin interface access immediately. Block TCP access to the admin interface (default port 8000 for ESG) from all IP ranges except explicitly trusted internal management workstations or a dedicated management VLAN. This is the single most effective short-term mitigation if you cannot patch right now. This is consistent with zero-trust network segmentation principles — no management plane should be reachable from untrusted networks.
• Check all six affected products. Do not focus only on ESG. Audit your Barracuda Load Balancer ADC, WAF, Message Archiver, WAF Control Center, and Web Security Gateway deployments and apply the product-specific hotfixes listed above.

Short-term (within one week)

• Hunt for indicators of compromise. Review ESG access logs for unusual POST requests to the config import endpoint, unexpected configuration changes, new admin accounts, or outbound connections to unknown IPs initiated from the appliance itself. Treat any anomaly as a potential compromise until ruled out.
• Rotate credentials and certificates. If there is any doubt about whether the appliance was accessed before the patch was applied, rotate all credentials stored in or used by the ESG — including LDAP/AD service accounts, SMTP relay credentials, and any API keys. An attacker with root access can read these from the filesystem.
• Check for firmware integrity. Barracuda appliances with root-level compromise can have their firmware modified. Consider a factory reset and clean re-deployment for any appliance where you cannot definitively rule out pre-patch exploitation, especially those with admin interfaces that were internet-accessible.
• Apply compensating controls to WAF and ADC. The command injection in CVE-2026-111560 also affects your Barracuda WAF and Load Balancer ADC — perimeter devices that handle HTTPS traffic. These should be patched and their management access locked down with the same urgency.

Strategic (within 30 days)

• Evaluate your Barracuda exposure holistically. This is the second major exploit chain on Barracuda ESG in three years. The 2023 campaign by UNC4841 was so severe that the FBI advised full appliance replacement rather than patching. While the current advisory does not rise to that level, organisations should assess whether their email security architecture has sufficient defence-in-depth — particularly whether a compromised ESG could serve as a beachhead for a broader breach, as happened in numerous enterprise appliance attacks we have tracked this year.
• Consider zero-trust email architecture. Modern zero-trust architectures treat the email security gateway as an untrusted relay — not a device with broad internal network access. If your ESG has unrestricted reach to internal mail servers, Active Directory, file shares, or other critical assets, now is the time to redesign that connectivity to follow least-privilege principles.
• Add Barracuda to your vulnerability management programme. Assign this product family to a track that ensures firmware updates are assessed and deployed within 72 hours of a critical advisory. Barracuda provides security patches via Energize Updates; automate notifications.

Frequently Asked Questions

Is CVE-2026-116606 being actively exploited in the wild?

As of 6 November 2026, neither CVE-2026-116606 nor CVE-2026-111560 appears in CISA’s Known Exploited Vulnerabilities (KEV) catalog, and no major vendor has published confirmed victim reports. However, watchTowr’s public proof-of-concept and the widespread media coverage make exploitation in the near term highly probable. The window between public disclosure of a critical appliance exploit and first observed mass exploitation is typically measured in days, not weeks.

My Barracuda ESG admin port is not on the internet — am I still at risk?

Your immediate risk is significantly reduced if the admin interface is genuinely inaccessible from untrusted networks. That said, you should still apply the patch. Additionally, verify that your firewall rules actually enforce this restriction — many organisations have shadow rules or VLAN misconfigurations that inadvertently expose management ports. Run an external port scan against your ESG’s IP address from an internet-connected source to confirm.

We use Barracuda WAF and ADC, but not ESG — do we need to act?

Yes. CVE-2026-111560 affects the command injection module shared by the Load Balancer ADC, WAF, Message Archiver, WAF Control Center, and Web Security Gateway. While the most critical chained exploit requires both CVEs and therefore targets ESG specifically, CVE-2026-111560 alone on a WAF or ADC can be triggered if an attacker can reach a vulnerable code path through those products’ own interfaces. Apply the product-specific hotfixes (BNADC-16586 for ADC/WAF, etc.) promptly.

How does this compare to the 2023 Barracuda ESG attack (CVE-2023-2868)?

CVE-2023-2868 was a different vulnerability — an input validation flaw in email attachment processing — that the China-linked threat actor UNC4841 exploited for eight months before discovery. It led to deep, persistent compromise of government and enterprise networks globally and prompted the FBI’s extraordinary recommendation to physically replace all ESG hardware. The current chain (CVE-2026-116606 + CVE-2026-111560) is different in nature and origin, and there is no evidence of nation-state pre-patch exploitation at this time. However, the product history means that threat actors specifically look for new ESG vulnerabilities, so the risk calculus for Barracuda customers is higher than for comparable products from vendors without this track record.

The Bottom Line

A CVSS 9.3 + 8.6 pre-authentication root chain on a device sitting at your email perimeter is about as serious as vulnerabilities get. The patch is available, the exploit technique is public, and the product family has a history of targeted nation-state exploitation. There is no good reason to defer remediation.

If your organisation runs Barracuda Email Security Gateway, WAF, Load Balancer ADC, Message Archiver, WAF Control Center, or Web Security Gateway — patch today, restrict management access, and audit for indicators of compromise. If you are unsure about your exposure or need a rapid assessment of your email security architecture, get in touch for a security assessment. Identifying and closing these gaps before an attacker does is exactly the work P J Networks exists to do.