Summary. On 10 November CISA added two Barracuda vulnerabilities, CVE-2026-116606 and CVE-2026-111560, to its Known Exploited Vulnerabilities (KEV) catalog. Each entry carries a due date of 13 November, which is today, and CISA marks both as requiring forensic triage. Barracuda’s advisory says that if the two are exploited in combination, an attacker could bypass authorization and obtain root, and that it has “identified exploitation activity affecting a small number of organizations.” Its table lists the Email Security Gateway (ESG) as the only product affected by both. The vendor does not say which flaw or which product was exploited. No evidence found as of 13 November, in the Barracuda advisory, the Mandiant disclosures and the KEV entries, of a named actor.
What the flaws are
CVE-2026-116606 affects ESG only. Per the CVE record, it is an authentication bypass (CWE-288) that lets an unauthenticated remote attacker invoke a configuration-import function and restore a crafted, compatible backup archive, modifying the appliance’s global configuration. The CNA (Mandiant) scores it CVSS 4.0 9.3 (the same figure Barracuda’s advisory lists); NVD’s primary score (CVSS 3.1) is 9.8 Critical. ESG versions earlier than 9.4.0.030 are listed as affected in the CVE record (Mandiant disclosure MNDT-2026-0042); we have not matched that to Barracuda’s patch labels below.
CVE-2026-111560 is an OS command injection (CWE-78) in the timezone configuration field. An authenticated administrator can inject commands that run as root when the value is later processed. The CNA score is CVSS 4.0 8.6 (the same figure Barracuda’s advisory lists); NVD’s primary score (CVSS 3.1) is 7.2 High. It affects ESG, Load Balancer ADC, Web Application Firewall, WAF Control Center, Web Security Gateway and Message Archiver. Mandiant’s disclosure MNDT-2026-0041 lists ESG up to 9.4.0.27, ADC up to 6.4.0, WAF up to 11.0.1, WSG up to 16.1.100.100, Message Archiver up to 5.5.4.0 and WCC up to 2.2.1.
CISA’s KEV entries state that each can be chained with the other. Our reading, not stated by a source: the first flaw removes the credential requirement and the second turns that access into root.
The condition that matters
Barracuda’s advisory says exploitation requires the attacker to reach the administrative web interface. On 5 November it changed the first flaw’s authentication field from “Yes, administrative access” to “No (Administrative UI Access Required)”: no authentication is needed, but the Admin UI must be reachable. It advises restricting that interface to trusted internal networks.
Sector implications
Our assessment: ESG sits in the mail path of the organizations that run it, and a root-level compromise of the appliance gives an attacker a position to read or alter mail flow and to pivot inward. Barracuda has not said which sectors were hit, so any sector exposure is our reasoning, not victim reporting.
Recommended actions
- Patch today. ESG: BNSF-40425 (9.4.017 and later) or BNSF-40430 (earlier than 9.4.017). ADC and WAF: BNADC-16586. Message Archiver: BNMA-32468. WCC: BNWF-60060. WSG: BNYF-24789. Confirm the firmware version shown on each device, and note that devices several versions behind may need more than one update.
- Remove Admin UI exposure. Check whether any management interface is reachable from the internet and restrict it to internal networks.
- Triage, not just patch. CISA flags forensic triage. These checks are our suggestions, not vendor or CISA guidance: review ESG and other affected devices for unexpected configuration restores, unexplained changes to global configuration or timezone values, and unknown administrator accounts. No evidence found as of 13 November of published indicators of compromise in the Barracuda advisory, the Mandiant disclosures or the KEV entries, so those are the places to watch.
- Check automatic patching. Barracuda recommends enabling automatic patch delivery on devices where it was turned off.
What we do not know
No evidence found as of 13 November, in the Barracuda advisory, the Mandiant disclosures and the CISA entries, of a named threat actor, a victim count beyond “a small number,” or indicators of compromise. CISA lists known ransomware campaign use as “Unknown” for both.