Barracuda Email Security Gateway Vulnerability Exploited for Root Access

What Happened

BleepingComputer reported on November 10, 2026 that Barracuda Networks warned attackers have begun exploiting two recently patched Barracuda Email Security Gateway vulnerabilities that let them run commands with root privileges. Both are described as critical. The Barracuda Email Security Gateway vulnerability tracked as CVE-2026-116606 is an authentication bypass, and CISA's Known Exploited Vulnerabilities catalog states it can be chained with CVE-2026-111560, an OS command injection.

That catalog listing matters to MSPs because it means the flaws are not theoretical. CISA's required action for both entries is to apply mitigations in accordance with vendor instructions, to follow its BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable, and to evaluate each asset's internet exposure and adhere to BOD 26-04 patching guidelines.

An email security appliance is shared infrastructure. A compromise there touches every mailbox behind it rather than one user's account, and that is why the gap between exposure and patch is the part that costs an MSP money. Add the time spent rebuilding, the client conversations, and the work that gets displaced while you deal with it.

Timeline

• November 10, 2026: CISA's Known Exploited Vulnerabilities catalog publishes entries for CVE-2026-116606 and CVE-2026-111560 with a required action to apply mitigations in accordance with vendor instructions.
• November 10, 2026: BleepingComputer reports that Barracuda Networks warned attackers have begun exploiting the two recently patched flaws to run commands with root privileges.

Who Is Affected by the Barracuda Email Security Gateway Vulnerability

Any MSP running Barracuda appliances for clients starts here. CISA's entry for CVE-2026-111560 names Email Security Gateway (ESG), Load Balancer, Application Delivery Controller (ADC), Message Archiver (BMA), WAF Control Center (WCC), Web Application Firewall (WAF) and Web Security Gateway (WSG). The exploited chain that Barracuda warned about centres on the Email Security Gateway, which sits in front of client mail.

No victim count, no named victims and no geography have been published in the sources for this story. That absence is not reassurance. If a client appliance runs a version older than the fixed release, the exposure is the version, not whether an attack has already been attributed to that client.

Technical Details

CVE-2026-116606, as CISA states it: "Barracuda Networks Email Security Gateway (ESG) contains an authentication bypass using an alternate path or channel that could allow an unauthenticated remote attacker to invoke a configuration-import function and restore a crafted, compatible backup archive, resulting in unauthorized modification of the appliance's global configuration. This vulnerability can be chained with CVE-2026-111560."

CVE-2026-111560, as CISA states it: "Barracuda Networks Email Security Gateway (ESG), Load Balancer, Application Delivery Controller (ADC), Message Archiver (BMA), WAF Control Center (WCC), Web Application Firewall (WAF), and Web Security Gateway (WSG) contain an OS command injection vulnerability. This vulnerability could allow an authenticated administrator to inject OS commands that execute with root privileges when the crafted timezone value is subsequently processed. This vulnerability can be chained with CVE-2026-116606."

The versions named as affected for this story:

• Barracuda Email Security Gateway (ESG) prior to 9.4.0.030
• Barracuda Load Balancer Application Delivery Controller (ADC) prior to 6.4.0
• Barracuda Web Application Firewall (WAF) prior to 11.0.1
• Barracuda Web Security Gateway (WSG) prior to 16.1.100.100
• Barracuda Message Archiver (BMA) prior to 5.5.4.0
• Barracuda WAF Control Center (WCC) prior to 2.2.1 Update 1

What MSPs Should Do

Treat this as a patch and verify job, not a patch only job. The affected ranges are written as versions prior to a fixed release, so the first question is which appliances are still behind, and the second is whether anything on them was changed.

1. Inventory every Barracuda appliance you manage. Record the product and the exact version, and compare it against the affected ranges above.
2. Prioritize internet-facing instances. An ESG that accepts mail from the internet is reachable by anyone, and internet exposure is what CISA asks you to evaluate.
3. Apply mitigations in accordance with vendor instructions. That is the required action CISA states for both entries, with BOD 26-04 guidance for cloud services, and discontinuation of the product if mitigations are unavailable.
4. Review the appliance's global configuration for changes you did not make. The authentication bypass CISA describes results in unauthorized modification of that configuration.
5. Rotate credentials the appliance holds or can reach, including administrator accounts and any account it uses to authenticate elsewhere.
6. Check mail routing and filtering rules for entries you cannot account for, and confirm alerting still points where you expect it to.
7. Restrict management access. As a standing practice, appliance administration should not be reachable from the open internet.
8. Write down what you found and when you patched it, and tell the client. If the appliance was exposed, that record is what supports an honest conversation later.
9. Keep checking vendor advisories for these products and apply updates as they become available.

How EnterProtect Helps

An exploited appliance becomes an availability problem as much as a security one. Rebuilding an email gateway takes time the client does not have, and it takes clean copies of the things you need back.

EnterProtect backup keeps clean, restorable copies of client systems, so recovery starts from something you already hold rather than from whatever state the appliance is left in. EnterProtect recovery gets a client running again after a rebuild or an incident, worked as a recovery rather than an improvisation.

EnterProtect vulnerability scanning surfaces exposed versions across managed environments as a standing practice, which is how patch work becomes a schedule instead of a scramble.

Frequently Asked Questions

What Is CVE-2026-116606?

CISA describes it as an authentication bypass using an alternate path or channel in Barracuda Email Security Gateway (ESG). It could allow an unauthenticated remote attacker to invoke a configuration-import function and restore a crafted, compatible backup archive, resulting in unauthorized modification of the appliance's global configuration. CISA states it can be chained with CVE-2026-111560.

Are the Barracuda ESG Flaws Being Exploited?

Yes. BleepingComputer reported on November 10, 2026 that Barracuda Networks warned attackers have begun exploiting two recently patched ESG vulnerabilities that let them run commands with root privileges. Both CVE-2026-116606 and CVE-2026-111560 are listed in CISA's Known Exploited Vulnerabilities catalog, with a required action to apply mitigations in accordance with vendor instructions.

Which Barracuda Products and Versions Are Affected?

The affected versions in this story are: Barracuda Email Security Gateway (ESG) prior to 9.4.0.030, Barracuda Load Balancer Application Delivery Controller (ADC) prior to 6.4.0, Barracuda Web Application Firewall (WAF) prior to 11.0.1, Barracuda Web Security Gateway (WSG) prior to 16.1.100.100, Barracuda Message Archiver (BMA) prior to 5.5.4.0, and Barracuda WAF Control Center (WCC) prior to 2.2.1 Update 1. Check any client appliance against that list before anything else.

Can the Two Barracuda Flaws Be Used Together?

CISA states that CVE-2026-116606 can be chained with CVE-2026-111560, and that CVE-2026-111560 can be chained with CVE-2026-116606. The first is an authentication bypass that needs no credentials. The second is an OS command injection that could allow an authenticated administrator to inject OS commands that execute with root privileges when the crafted timezone value is subsequently processed.

What Should an MSP Do First When a Client Runs a Barracuda ESG?

Inventory the appliance and its exact version first, because patching requires knowing what you are patching. Apply mitigations in accordance with vendor instructions, which is the required action CISA states, and follow its guidance for cloud services or discontinue use of the product if mitigations are unavailable. Then review the global configuration for changes you did not make, and treat internet-facing management access as a priority.

Sources

• Barracuda Networks Email Security Gateway (ESG) Authentication Bypass Using an Alternate Path or Channel Vulnerability (Cisa Kev)
• Barracuda Networks Multiple Products OS Command Injection Vulnerability (Cisa Kev)
• Hackers now exploit critical Barracuda ESG flaws to gain root access (Bleepingcomputer)