Barracuda ESG pre-auth auth bypass + command injection chained for root RCE (CVE-2026-116606, CVE-2026-111560)
Severity: critical · Patch status: patched · Since 2026-11-02 · CVE-2026-111560, CVE-2026-116606
Barracuda disclosed and patched two flaws in its Email Security Gateway on 2026-11-02: CVE-2026-116606, a CVSS 9.3 pre-authentication authorization bypass requiring network access to the admin UI, and CVE-2026-111560, a CVSS 8.6 command-injection flaw also affecting its ADC, BMA, WAF, WCC, and WSG products. Chained, they allow an unauthenticated attacker to bypass authorization and execute commands with root privileges. In a 2026-11-10 update Barracuda confirmed active exploitation affecting a small number of organizations; it declined to say how many or who is responsible. Root access could enable data theft, backdoors, and full system control. Edge-device exploits of this type have previously been used by PRC-linked actors against Barracuda ESGs. Patches were released promptly and Barracuda worked directly with affected organizations.
What to do
- Immediately close or restrict internet-facing access to the ESG admin UI
- Apply the latest Barracuda patches for ESG and any affected ADC, BMA, WAF, WCC, or WSG appliances
- Assume possible compromise: check for root-level access, backdoors, and data exfiltration on exposed devices
- Hunt for signs of the exploitation activity Barracuda reported and review logs for anomalous admin-UI access
- Follow Barracuda's guidance on remediation, including possible appliance replacement if compromise is confirmed
Sources
All live incidents on Threat Watch
