Barracuda ESG, WAF and ADC flaws exploited: patch and lock down the admin UI

What happened

On 2 November 2026 Barracuda published an advisory for two vulnerabilities in several of its appliances, and Mandiant, which assigned the CVE numbers, published matching disclosures. One lets an attacker skip the login and change an Email Security Gateway’s configuration. The other lets an administrator run commands as root. Barracuda says that if the two are “exploited in combination, these vulnerabilities could allow an attacker to bypass authorization controls and obtain root access to the device.”

On 9 November Barracuda updated the advisory: “We have identified exploitation activity affecting a small number of organizations.” On 10 November CISA added both CVEs to its Known Exploited Vulnerabilities (KEV) catalog, with a deadline of 13 November for US federal agencies. CISA also marked both for forensic triage. Under its directive BOD 26-04, that means agencies have to work out whether a device was already compromised, not just patch it.

The two bugs

CVE-2026-116606: authentication bypass (Email Security Gateway only). An unauthenticated attacker can call a configuration-import function and restore “a crafted, compatible backup archive”, changing the appliance’s global configuration. It affects ESG versions earlier than 9.4.0.030 and is scored 9.3 (CVSS 4.0). On 5 November Barracuda corrected its advisory: no login is needed, but the attacker does need to reach the administrative interface.

CVE-2026-111560: command injection (six products). The timezone setting doesn’t neutralise shell characters, so an administrator can plant a value that runs operating-system commands as root when the appliance processes it. On its own it needs admin access and is scored 8.6, but on an ESG the bypass above opens the door.

Affected products and patches

Patch IDs are copied exactly as Barracuda lists them. Version limits come from the CVE records.

Barracuda’s advice:

• Check each device shows the latest firmware and has the patch. A device several versions behind may need more than one update.
• If a patch hasn’t been applied automatically, apply it by hand. If you’ve turned automatic patching off, Barracuda recommends switching it back on.
• Ask Barracuda Support (support@barracuda.com) if you can’t confirm the firmware or patch level.

Get the admin interface off the internet

Barracuda says organisations whose admin interfaces aren’t publicly reachable “are less exposed to this attack path”, and recommends limiting them to trusted internal networks. That matters beyond this bug: an appliance admin page reachable from anywhere turns every future login flaw into an internet-wide problem.

• Allow the admin port only from a management network, VPN or a short list of fixed addresses.
• Test from outside your network (a phone on mobile data works) that the admin page doesn’t load.
• Keep the WAF’s or load balancer’s public listeners separate from its management interface, so protecting your websites doesn’t mean exposing the box that protects them.

The same lesson came up with the Ivanti Connect Secure chain: edge devices are high-value targets because they sit in front of everything else.

Check whether a device was already hit

Barracuda hasn’t published indicators of compromise. If an affected appliance had an internet-facing admin interface before it was patched, these are sensible checks (our suggestions, not Barracuda’s):

• Configuration: compare the running configuration with a known-good backup. Look for changed DNS, mail-routing, relay or forwarding rules, new administrators, and changed alert or syslog destinations.
• Timezone value: it should be an ordinary timezone name. Anything containing shell characters such as ;, |, $( or backticks is a red flag.
• Logs: look for configuration restores or imports, and administrator logins, that nobody on your team made.
• Secrets: a root-level attacker could read what the device stores. Rotate administrator passwords, API keys, LDAP or directory bind credentials, and any TLS private keys the appliance holds.

If you find signs of compromise, contact Barracuda Support before you rebuild or restore the device, so you don’t destroy evidence they may need.

Sources

• Barracuda: Pre-authentication authorization bypass and command injection vulnerabilities in certain Barracuda products (published 2 November 2026, updated 9 November) (opens in a new tab)
• CVE record: CVE-2026-116606 (opens in a new tab)
• CVE record: CVE-2026-111560 (opens in a new tab)
• Mandiant disclosure MNDT-2026-0042 (CVE-2026-116606) (opens in a new tab)
• Mandiant disclosure MNDT-2026-0041 (CVE-2026-111560) (opens in a new tab)
• CISA: CISA Adds Six Known Exploited Vulnerabilities to Catalog (10 November 2026) (opens in a new tab)
• CISA: BOD 26-04, Prioritizing Security Updates Based on Risk (opens in a new tab)