Barracuda CVE-2026-116606: How to Check and Patch Your ESG
Barracuda published fixes on November 2, 2026, for two flaws that can be chained to get root on its appliances: CVE-2026-116606, an authorization bypass in the Email Security Gateway (ESG), and CVE-2026-111560, a command injection that also affects the WAF, Load Balancer ADC, Message Archiver, Web Security Gateway and WAF Control Center. Check that each appliance has its patch (BNSF-40425 or BNSF-40430 on ESG), apply it by hand if it hasn’t arrived automatically, and keep the admin interface off the internet.
Below: which products are affected, the patch ID for each, how to confirm a device is patched, and the points where Barracuda’s advisory and the CVE records don’t agree.
Before you start
- Applies to: Barracuda Email Security Gateway, Web Application Firewall, Load Balancer ADC, Message Archiver, Web Security Gateway and WAF Control Center (hardware and virtual)
- You need: admin access to each appliance’s web interface
- Time: 10 to 15 minutes per device, longer if it is several firmware versions behind
- Checked: November 5, 2026, against Barracuda’s advisory and Mandiant’s CVE disclosures
What Barracuda fixed
Barracuda’s advisory, titled “Pre-Authentication Authorization Bypass and Command Injection Vulnerabilities in Certain Barracuda Products,” went up on November 2, 2026. The CVE records were published by Mandiant, which lists Barracuda itself as the reporter.
- CVE-2026-116606 (CVSS v4.0 9.3): an authorization bypass in the ESG’s administrative interface (CWE-288, authentication bypass using an alternate path).
- CVE-2026-111560 (CVSS v4.0 8.6): an OS command injection (CWE-78) that runs commands on the appliance once an attacker has admin-level access.
Chained, the first gets an attacker into the admin interface and the second turns that into root on the device. That is why the ESG, which is hit by both, is the priority.
Is it being exploited?
Barracuda’s advisory makes no exploitation statement. Security firm Ostorlab said neither CVE was in CISA’s Known Exploited Vulnerabilities catalog as of November 2, and none of the coverage we reviewed reports attacks. Barracuda ESG has been targeted at scale before (CVE-2023-2868 in 2023), so don’t read “no reports yet” as a reason to wait.
Affected products and patch IDs
| Product | CVE-2026-116606 | CVE-2026-111560 | Patch ID |
|---|---|---|---|
| Email Security Gateway (ESG) | Yes | Yes | BNSF-40425 (9.4.017 and later), BNSF-40430 (below 9.4.017) |
| Web Application Firewall (WAF) | No | Yes | BNADC-16586 |
| Load Balancer ADC | No | Yes | BNADC-16586 |
| Message Archiver (BMA) | No | Yes | BNMA-32468 |
| Web Security Gateway (WSG) | No | Yes | BNYF-24789 |
| WAF Control Center (WCC) | No | Yes | BNWF-60060 |
Mandiant’s records add version ranges: ESG below 9.4.0.030 for CVE-2026-116606; and for CVE-2026-111560, ESG 9.4.0.27 and earlier, Load Balancer ADC 6.4.0 and earlier, WAF 11.0.1 and earlier, WSG 16.1.100.100 and earlier, Message Archiver 5.5.4.0 and earlier, and WCC 2.2.1 and earlier. Barracuda’s own table uses patch IDs and a “9.4.017” threshold rather than build numbers, so go by the patch ID on the device.
How to check and patch each appliance
- List every appliance. Include virtual and cloud-hosted instances and any box a former IT provider set up. A forgotten Message Archiver is still exposed to CVE-2026-111560.
- Sign in to the admin interface and note the firmware version. Barracuda says the interface also shows the latest version available.
- Look for the patch ID from the table above in the device’s update or patch history. Patches can arrive automatically, but the advisory does not say every device has received them.
- Apply the patch manually if it’s missing. Barracuda links to its Campus documentation for the manual steps (see Sources).
- Turn automatic patching back on if someone disabled it. Barracuda recommends that all devices receive patches automatically.
- Contact support@barracuda.com for a device that is several firmware versions behind, as the advisory asks.
Lock down the admin interface
Barracuda states that “successful exploitation requires an attacker to have access to the administrative interface,” and recommends restricting it to trusted internal networks. Even after patching:
- Remove any firewall or NAT rule that publishes the admin port to the internet.
- Allow admin access only from a management VLAN, a VPN range or specific admin IPs.
- Rotate admin passwords if the interface has been reachable from outside, and check that every admin account is one you recognize.
Where the sources disagree
Two points are worth knowing before you brief anyone:
- Is CVE-2026-116606 pre-authentication? Barracuda’s advisory title says “pre-authentication,” yet its CVE entry lists “Authentication Required: Yes, administrative access.” Mandiant’s record says the bypass “is exposed to an unauthenticated remote attacker” and scores it with no privileges required. Treat it as reachable without a login until Barracuda clarifies.
- Severity label. Barracuda labels both flaws “High,” but a CVSS v4.0 score of 9.3 falls in the Critical band, which is how most outlets describe it.
Signs to look for after patching
Neither Barracuda nor Mandiant has published indicators of compromise. Ostorlab suggests reviewing configuration-import history, comparing the current configuration against a known-good backup, and reading admin logs for logins from unfamiliar IPs. If the ESG handled mail for your domain, also check that SPF, DKIM and DMARC records haven’t been altered.
FAQ
Do I have to do anything if automatic updates are on?
Yes, confirm it. Barracuda’s wording is that patches may be applied automatically; check the patch history for the ID in the table rather than assuming.
Is the Barracuda Email Protection cloud service affected?
The advisory lists only the six appliance product lines above. Cloud-only Email Protection is not in Barracuda’s table.
Does this affect the ESG appliances Barracuda told customers to replace in 2023?
Barracuda’s 2023 guidance was to replace compromised ESG hardware from the CVE-2023-2868 attacks. Any ESG still in service, old or new, needs this patch.
Next step
Open the admin interface of each Barracuda appliance today and match its patch history to the table. If your mail runs through the ESG, our guide to SPF, DKIM and DMARC shows how to confirm your DNS records are still correct. For other self-hosted software patched this week, see our WordPress CVE-2026-119977 update check and the GitLab CVE-2026-97229 patch guide.
How we checked: patch IDs and the product list come from Barracuda’s advisory dated November 2, 2026; scores, CWE classes and version ranges come from Mandiant’s disclosures MNDT-2026-0041 and MNDT-2026-0042. We did not test the flaws. Barracuda has not published fixed build numbers, so version thresholds may change.
Sources
- Pre-Authentication Authorization Bypass and Command Injection Vulnerabilities in Certain Barracuda Products (Barracuda, Nov 2, 2026)
- MNDT-2026-0042: CVE-2026-116606 (Mandiant)
- MNDT-2026-0041: CVE-2026-111560 (Mandiant)
- Barracuda Campus: applying patches manually
- Barracuda ESG Pre-Auth Bypass to Root, Patched (Ostorlab, Nov 2, 2026)
