Barracuda ESG Exploited: Patch vs Admin UI Lockdown

Barracuda ESG exploited is no longer a theoretical risk. Barracuda Networks confirmed on 9 November 2026 that attackers are chaining CVE-2026-116606 and CVE-2026-111560 against its Email Security Gateway, and CISA added both to its Known Exploited Vulnerabilities catalogue on 10 November with a federal deadline of 13 November. Of the two defences available, patching to firmware 9.4.0.029 or later wins; restricting the Admin UI is a same-hour stopgap that shrinks exposure without removing the flaw.

TL;DR

• Two flaws chain to give root on the Barracuda Email Security Gateway (ESG): a pre-authentication authorisation bypass and an OS command injection.
• Barracuda says exploitation is "affecting a small number of organizations" and has not published a count, victim names or indicators of compromise.
• CISA added both CVEs to the KEV catalogue on 10 November 2026 and set a 13 November deadline for US federal civilian agencies, including forensic triage.
• Verdict: patch first, restrict the Admin UI as a stopgap, then hunt for signs of earlier compromise. Patching alone does not remove an intruder.
• No Indian victim is publicly named, but Indian organisations running the appliance carry a six-hour CERT-In reporting duty if they find exploitation.

Is the Barracuda ESG exploited in the wild, and by what chain?

Yes. Barracuda's security advisory was published on 2 November and updated on 5 and 9 November. The 9 November update states that the company has identified exploitation activity affecting a small number of organisations. The Canadian Centre for Cyber Security also notes that open source reporting indicates CVE-2026-116606 is exploited in the wild.

The two flaws work as follows:

• CVE-2026-116606 is a pre-authentication authorisation bypass with a CVSS score of 9.3. It affects only the ESG. Barracuda lists authentication as not required, but the Administrative UI must be reachable by the attacker.
• CVE-2026-111560 is a command injection with a CVSS score of 8.6. It affects the ESG, Load Balancer ADC, Message Archiver, WAF Control Center, Web Application Firewall and Web Security Gateway, and it needs an admin login on its own.

Chained, the first removes the need for credentials and the second supplies code execution. CISA's KEV entries describe the mechanism at a high level: an unauthenticated attacker invokes the configuration-import function and restores a crafted backup archive, which alters the global configuration, and injected commands then run with root privileges when a crafted timezone value is processed. This article deliberately goes no further than that.

Patch or lock down the Admin UI: which defence wins?

Patching wins. The table compares the two on the points that matter during an active campaign.

Barracuda's guidance covers both: keep the Admin UI off untrusted networks, verify the installed firmware version, and keep automatic patching on. If it was disabled, patch manually. Close the exposure first because it takes minutes; patch immediately afterwards because only the patch removes the flaw.

Which patch IDs and firmware versions fix it?

For the ESG, Barracuda lists BNSF-40425 for firmware 9.4.017 and later, and BNSF-40430 for builds older than 9.4.017. Appliances should end on 9.4.0.029 or later according to Barracuda's documentation. Units below 9.1 must update in two steps.

The other products are affected by CVE-2026-111560 only:

• Load Balancer ADC and WAF: BNADC-16586
• Message Archiver: BNMA-32468
• WAF Control Center: BNWF-60060
• Web Security Gateway: BNYF-24789

After updating, check the Current Installed Version field rather than assuming the job completed.

Does patching evict an attacker who is already in?

No. CISA flagged both entries for forensic triage, a statement that exploitation may predate your patch. The exposure window runs from the advisory on 2 November, and watchTowr Labs published the full chain on 5 November, so working knowledge of it has been public since then.

A sensible hunt over that period looks for:

• Configuration restores nobody on your team performed
• New admin accounts or API keys
• Firmware patch events you did not schedule
• Unexpected outbound connections from the appliance

Barracuda has released no indicators of compromise for the attacks it saw, so these checks are generic, a starting point rather than a guarantee. watchTowr's GitHub detection artefact generator tests susceptibility.

A quick external check: from outside your network, see whether the gateway answers on its admin interface, which commonly listens on port 8000. A timeout or refused connection is the result you want.

What do we still not know about the Barracuda ESG attacks?

Several things:

• How many organisations were breached. "A small number" is the vendor's only wording.
• Who is behind the activity, and whether any data was stolen.
• Whether attackers actually reached root in the observed intrusions.
• Whether any Indian organisation is affected.

The history explains why this matters. In May 2023 the same product line was mass-exploited through CVE-2023-2868, attributed by Mandiant to UNC4841, and Barracuda ended up replacing appliances rather than patching them. Nothing published so far says the 2026 campaign is of that scale.

What does the Barracuda ESG exploited alert mean for Indian organisations?

No Indian victim has been publicly named, and CERT-In has not issued a separate ESG notice at the time of writing. The obligation still applies. Under the CERT-In Directions of 28 April 2022, issued under section 70B(6) of the IT Act, service providers, intermediaries, data centres and body corporates must report cyber incidents within six hours of noticing them. Reports go to incident@cert-in.org.in or 1800-11-4949. An Indian organisation that finds exploitation of its Barracuda gateway is inside that window from the moment it notices.

How does this compare with other recent exploited edge flaws?

The pattern is familiar: a perimeter appliance, a short gap between patch and exploitation, and a KEV deadline. See our coverage of OpenSSH exploited 40 hours after the patch, the three Ivanti Connect Secure zero-days and their CISA deadline, the WordPress CVE-2026-119977 patch-first decision and the Synology C3rb3r ransomware campaign against outdated DSM. The lesson repeats: unpatched edge devices are where attackers look first.

FAQ

Q: What are the CVEs in the Barracuda ESG exploited chain?
A: CVE-2026-116606 (CVSS 9.3) is a pre-authentication authorisation bypass affecting only the ESG, and CVE-2026-111560 (CVSS 8.6) is a command injection affecting several Barracuda products. Together they give root access on the ESG.

Q: What is the CISA deadline for the Barracuda flaws?
A: 13 November 2026, per CISA's 10 November KEV addition, for US federal civilian agencies to patch and complete forensic triage. Everyone else should treat it as a same-day priority.

Q: Which firmware version fixes the Barracuda ESG vulnerabilities?
A: Appliances should be on firmware 9.4.0.029 or later, applied through patch BNSF-40425 or BNSF-40430 depending on the current build. Units below 9.1 need a two-step update.

Q: Is restricting the Admin UI enough to stay safe?
A: No. It cuts internet exposure to the no-login attack, but the flaw remains and an inside attacker can still reach the UI. Patch as well and hunt for earlier compromise.

Q: Do I need to report Barracuda ESG exploitation in India?
A: Yes, if you notice it. CERT-In's 2022 Directions require reporting of cyber incidents within six hours to incident@cert-in.org.in or 1800-11-4949.