{"slug":"barracuda-esg-auth-bypass-cve-2026-116606","title":"Barracuda ESG authentication bypass (CVE-2026-116606)","shortName":"Barracuda ESG","seoTitle":"Barracuda ESG (CVE-2026-116606): versions, exploitation & detection","summary":"Confirmed exploited (CISA KEV, 10 Nov 2026, and Barracuda, 9 Nov 2026). CISA listed both CVE-2026-116606 and CVE-2026-111560 (catalog 2026.11.10, due 13 Nov 2026; ransomware use Unknown; forensic triage required). Barracuda's 9 Nov 2026 advisory still does not say which CVE or which product was exploited, and gives no victim count, actor, or IOCs. Pre-authentication authorization bypass in Barracuda Email Security Gateway (CVE-2026-116606, CWE-288, Mandiant CNA CVSS 4.0 9.3). No login is needed, but the admin UI must be reachable. Related CVE-2026-111560 is OS command injection (CWE-78, CVSS 4.0 8.6) that runs as root. CISA KEV lists 111560 for Email Security Gateway (ESG), Load Balancer, Application Delivery Controller (ADC), Message Archiver (BMA), WAF Control Center (WCC), Web Application Firewall (WAF), and Web Security Gateway (WSG); an authenticated administrator; and says it can be chained with CVE-2026-116606. On ESG the two chain from a reachable admin UI to privileged config access to root. On the other listed products, 111560 needs authenticated admin access (no bypass). Vendor patches are out (Barracuda advisory still last updated 9 Nov 2026 at 9:00pm EST). watchTowr published a Detection Artefact Generator; the repository's own interface takes an operator-supplied command, so this page indexes it on /pocs for defenders.","isExample":false,"draft":false,"family":"barracuda-esg-auth-bypass-cve-2026-116606","kind":"single-product","aliases":["CVE-2026-116606","CVE-2026-111560","MNDT-2026-0042","MNDT-2026-0041","Barracuda Email Security Gateway","Barracuda ESG auth bypass"],"publishedAt":"2026-11-05","updatedAt":"2026-11-10","patchStatus":"patched","exploited":true,"scores":{"cve":"CVE-2026-116606","cvss":{"cve":"CVE-2026-116606","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","version":"4.0","scorer":"cna","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-116606","sourceDate":"2026-11-02","checkedDate":"2026-11-05","dateLabel":"CNA published","sourceLabel":"Mandiant CNA (CVSS 4.0 9.3). NVD API 5 Nov 2026: Awaiting Analysis, Secondary CNA metric; no NVD-produced Primary. Related CVE-2026-111560 is CVSS 4.0 8.6.","nvdPublishedDate":"2026-11-02"},"epss":{"cve":"CVE-2026-116606","score":0.00728,"percentile":0.54331,"date":"2026-11-05","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-116606","checkedDate":"2026-11-05"},"kev":{"cve":"CVE-2026-116606","listed":true,"dateAdded":"2026-11-10","dueDate":"2026-11-13","catalogVersion":"2026.11.10","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","checkedDate":"2026-11-10"},"addedDate":"2026-11-05"},"priority":{"label":"act-now"},"managementSummary":{"what":"Barracuda Email Security Gateway authentication bypass (CVE-2026-116606, Mandiant CNA CVSS 4.0 9.3) plus related OS command injection (CVE-2026-111560, CVSS 4.0 8.6). CISA listed both CVEs in KEV on 10 Nov 2026 (catalog 2026.11.10, due 13 Nov 2026; ransomware use Unknown; forensic triage required). On ESG, a reachable admin UI is enough to chain privileged config access to root. On five other Barracuda products, CISA and Mandiant say 111560 needs an authenticated administrator. Barracuda (9 Nov 2026) reports exploitation activity affecting a small number of organizations; that advisory still does not name a CVE or product. The KEV rows name both CVEs. watchTowr's Detection Artefact Generator is indexed on /pocs for defenders; the repository's own interface takes an operator-supplied command.","action":"Apply the vendor patch for each product and confirm it is installed on-device. CISA KEV due date is 13 Nov 2026 for FCEB agencies. CISA marks forensic triage required: if an ESG Admin UI was reachable from the internet before patching, hunt that device for compromise, not just patch. Restrict the admin UI to trusted networks. Re-enable automatic patching where it was turned off. Barracuda has published no IOCs."},"seenInTheWild":[{"metric":"exploitation-confirmed","value":"Listed","observer":"CISA","date":"2026-11-10","method":"CISA KEV catalog 2026.11.10, released 2026-11-10T19:03:29.8375Z, 1,779 entries. CVE-2026-116606 dateAdded 2026-11-10, due 2026-11-13, CWE-288. CVE-2026-111560 dateAdded 2026-11-10, due 2026-11-13, CWE-78. Both: knownRansomwareCampaignUse Unknown, forensicTriage Yes. vulnerabilityName 116606: Barracuda Networks Email Security Gateway (ESG) Authentication Bypass Using an Alternate Path or Channel Vulnerability. vulnerabilityName 111560: Barracuda Networks Multiple Products OS Command Injection Vulnerability. This listing joins Barracuda's 9 Nov 2026 in-the-wild statement. CISA has not described the activity it observed.","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json"},{"metric":"vendor-stated","value":"We have identified exploitation activity affecting a small number of organizations.","observer":"Barracuda","date":"2026-11-09","method":"Barracuda advisory update 9 Nov 2026 at 9:00pm EST. Banner: We added information about exploitation activity that has been observed affecting a small number of organizations. Barracuda does not say which CVE or which product was exploited, and gives no victim count, actor, or IOCs. That is the advisory-update date, not a first calendar day of exploitation.","sourceUrl":"https://trust.barracuda.com/security/pre-authentication-authorization-bypass-command-injection"},{"metric":"third-party-stated","value":"Reads the Barracuda statement as the ESG chain, with CVE-2026-116606 exploited","observer":"SecurityOnline","date":"2026-11-10","method":"SecurityOnline (10 Nov 2026) reads Barracuda's 9 Nov statement as the ESG chain and names CVE-2026-116606 as exploited. That is a third-party reading only. Barracuda does not name a CVE or product.","sourceUrl":"https://securityonline.info/barracuda-esg-vulnerability-exploited-poc/"},{"metric":"third-party-stated","value":"Neither advisory says whether the flaws have been exploited, as of 4 Nov 2026","observer":"SecurityWeek","date":"2026-11-04","method":"Superseded 9 Nov 2026 by Barracuda's vendor exploitation statement. SecurityWeek (4 Nov 2026) wrote that neither the Barracuda nor Mandiant advisory said whether the flaws had been exploited. CISA ADP SSVC Exploitation is none (timestamp 2026-11-02). That was a 4-5 Nov check, not a first-seen exploitation day.","sourceUrl":"https://www.securityweek.com/barracuda-email-security-gateway-authentication-bypass-opens-path-to-root/"},{"metric":"third-party-stated","value":"Reports Barracuda's warning that attackers have begun exploiting the two ESG flaws","observer":"BleepingComputer","date":"2026-11-10","method":"Sergiu Gatlan, 10 Nov 2026, 05:10 AM (datePublished 2026-11-10T05:10:20-05:00). Title: Hackers now exploit critical Barracuda ESG flaws to gain root access. Relays Barracuda's 9 Nov advisory update and names CVE-2026-116606 and CVE-2026-111560. The article does not mention CISA KEV. This page does not take product-auth claims from that article.","sourceUrl":"https://www.bleepingcomputer.com/news/security/hackers-exploit-barracuda-email-security-gateway-flaws-to-get-root-access/"}],"seenInTheWildLinks":[{"title":"CISA Known Exploited Vulnerabilities catalog (CVE-2026-116606 and CVE-2026-111560 listed 10 Nov 2026)","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","observer":"CISA","metric":"exploitation-confirmed"},{"title":"Pre-Authentication Authorization Bypass and Command Injection Vulnerabilities in Certain Barracuda Products","url":"https://trust.barracuda.com/security/pre-authentication-authorization-bypass-command-injection","observer":"Barracuda","metric":"vendor-stated"},{"title":"Barracuda ESG Vulnerability Exploited, PoC Exploit Public","url":"https://securityonline.info/barracuda-esg-vulnerability-exploited-poc/","observer":"SecurityOnline","metric":"third-party-stated"},{"title":"Barracuda ESG Authentication Bypass Flaw Opens Path to Root","url":"https://www.securityweek.com/barracuda-email-security-gateway-authentication-bypass-opens-path-to-root/","observer":"SecurityWeek","metric":"third-party-stated"},{"title":"Barracuda warns of critical flaws allowing root access to devices","url":"https://www.bleepingcomputer.com/news/security/barracuda-warns-of-critical-flaws-allowing-root-access-to-devices/","observer":"BleepingComputer","metric":"third-party-stated"},{"title":"Hackers now exploit critical Barracuda ESG flaws to gain root access","url":"https://www.bleepingcomputer.com/news/security/hackers-exploit-barracuda-email-security-gateway-flaws-to-get-root-access/","observer":"BleepingComputer","metric":"third-party-stated"}],"whatChanged":{"date":"2026-11-10","items":[{"text":"CISA added CVE-2026-116606 (Barracuda Networks Email Security Gateway (ESG) Authentication Bypass Using an Alternate Path or Channel Vulnerability) and CVE-2026-111560 (Barracuda Networks Multiple Products OS Command Injection Vulnerability) to the Known Exploited Vulnerabilities catalog on 10 Nov 2026 (catalog 2026.11.10, released 2026-11-10T19:03:29.8375Z, 1,779 entries). Both rows: dateAdded 2026-11-10, dueDate 2026-11-13, knownRansomwareCampaignUse Unknown, forensicTriage Yes. CWE-288 (116606) and CWE-78 (111560). Badge: Exploited in the wild (KEV). This listing joins Barracuda's 9 Nov 2026 vendor statement. Barracuda's advisory still does not name a CVE or product; the KEV rows name both CVEs. CISA has not described the activity it observed. Verified 10 Nov 2026.","headline":"CISA listed CVE-2026-116606 and CVE-2026-111560 in KEV, due 13 Nov","section":"exploitation","date":"2026-11-10","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","alsoSourceUrl":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","addedDate":"2026-11-10"},{"text":"CISA marks forensic triage required on both KEV rows (forensicTriage Yes). CISA's requiredAction includes CISA's Forensics Triage Requirements. If an ESG Admin UI was reachable from the internet before patching, hunt that device for compromise, not just patch. Barracuda has published no IOCs. Hunt restore and configuration audit logs and unexpected temporary files from that window. A hit is a lead, not proof.","headline":"KEV requires forensic triage; hunt historically exposed ESG Admin UIs","section":"priority","date":"2026-11-10","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","alsoSourceUrl":"https://trust.barracuda.com/security/pre-authentication-authorization-bypass-command-injection","addedDate":"2026-11-10"},{"text":"Patches and mitigations are unchanged. Rechecked 10 Nov 2026: Barracuda advisory still last updated 9 Nov 2026 at 9:00pm EST; ESG BNSF-40425 / BNSF-40430, ADC and WAF BNADC-16586, Message Archiver BNMA-32468, WAF Control Center BNWF-60060, Web Security Gateway BNYF-24789. CISA KEV lists CVE-2026-111560 for Multiple Products: Email Security Gateway (ESG), Load Balancer, Application Delivery Controller (ADC), Message Archiver (BMA), WAF Control Center (WCC), Web Application Firewall (WAF), and Web Security Gateway (WSG). CISA: an authenticated administrator; this vulnerability can be chained with CVE-2026-116606. Keep every listed product in scope.","headline":"Patches unchanged; KEV lists 111560 on six Barracuda products","section":"fixed-versions","date":"2026-11-10","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","alsoSourceUrl":"https://trust.barracuda.com/security/pre-authentication-authorization-bypass-command-injection","addedDate":"2026-11-10"},{"text":"New catalog page for Barracuda Email Security Gateway authentication bypass CVE-2026-116606 and related command injection CVE-2026-111560.","headline":"New catalog page for Barracuda ESG CVE-2026-116606","section":"overview","date":"2026-11-05","kind":"page"},{"text":"Barracuda published patches on 2 Nov 2026 and updated the advisory on 5 Nov 2026 (2:30pm EST): CVE-2026-116606 needs no login, but the admin UI must be reachable. ESG patches are BNSF-40425 (9.4.017+) and BNSF-40430 (<9.4.017). Mandiant lists ESG <9.4.0.030 for 116606 and ESG <=9.4.0.27 for 111560. watchTowr compared 9.4.0.027 with 9.4.0.029 and tabulated Fixed In 9.4.0.029. Do not collapse those into one firmware. Confirm the vendor patch is installed on-device. 111560 also has product patches BNADC-16586 (ADC and WAF), BNMA-32468, BNWF-60060, and BNYF-24789.","headline":"Vendor patches are out; version sources disagree, confirm on-device","section":"fixed-versions","date":"2026-11-05","sourceUrl":"https://trust.barracuda.com/security/pre-authentication-authorization-bypass-command-injection","alsoSourceUrl":"https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2026/MNDT-2026-0042.md"},{"text":"Superseded 10 Nov 2026 by Barracuda's vendor exploitation statement and the CISA KEV listing. No known in-the-wild use as of 5 Nov 2026. SecurityWeek (4 Nov 2026) writes that neither advisory says whether the flaws have been exploited. CISA ADP SSVC Exploitation is none (timestamp 2026-11-02). Badge: No known ITW. Not in CISA KEV (catalog 2026.11.04, checked 5 Nov 2026). watchTowr / Sina Kheirkhah published primary research on 5 Nov 2026 and a Detection Artefact Generator (GitHub repo created 3 Nov 2026). The DAG is linked from Detection only, not /pocs. No Metasploit or Nuclei module confirmed as of 6 Nov 2026. PoC badge: No public PoC indexed.","headline":"Superseded: no known ITW as of 5 Nov; DAG was Detection only","section":"exploitation","date":"2026-11-05","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","alsoSourceUrl":"https://labs.watchtowr.com/barracuda-networks-is-your-new-best-friend-barracuda-email-security-gateway-pre-auth-remote-root-rce-cve-2026-116606-cve-2026-111560/","superseded":true}]},"whatTheBugIs":"CVE-2026-116606 is a pre-authentication authorization bypass in Barracuda Email Security Gateway (ESG). Mandiant published MNDT-2026-0042 and the CVE on 2 Nov 2026 (reserved 26 Oct 2026). CWE-288. Mandiant CNA: CVSS 4.0 9.3 Critical (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N). NVD API (checked 5 Nov 2026): vulnStatus Awaiting Analysis, published 2026-11-02T13:17:37.017, lastModified 2026-11-03T05:18:31.200. Secondary CNA metric only; no NVD-produced Primary. FIRST EPSS on 5 Nov 2026: 0.00728 (54.331st percentile).\n\nRelated CVE-2026-111560 is OS command injection in shared Barracuda appliance code. Mandiant published MNDT-2026-0041 and the CVE on 2 Nov 2026 (reserved 16 Oct 2026). CWE-78. Mandiant CNA: CVSS 4.0 8.6 High (CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N). NVD API (checked 5 Nov 2026): Awaiting Analysis, published 2026-11-02T13:17:35.190. FIRST EPSS on 5 Nov 2026 for 111560: 0.00471 (40.872nd percentile). This page does not describe request, handler, or field-level mechanics.\n\nBarracuda (advisory published 2 Nov 2026, updated 5 Nov 2026 at 2:30pm EST and 9 Nov 2026 at 9:00pm EST): authentication is not required for CVE-2026-116606, but the administrative user interface must be reachable. If the two issues are used together, an attacker can bypass authorization controls and obtain root access to the device. Mandiant: an unauthenticated remote attacker may restore a crafted, compatible backup archive and change the appliance's global configuration (116606). An authenticated administrator may cause OS commands to run with root privileges when crafted configuration is later processed (111560). Keep the path generic: reachable admin UI, then privileged config access, then unsafe config processing as root.\n\nScope. 116606: ESG only (vendor Yes; Mandiant ESG < 9.4.0.030; CISA KEV product Barracuda Email Security Gateway (ESG)). 111560: CISA KEV (catalog 2026.11.10) lists Multiple Products: Email Security Gateway (ESG), Load Balancer, Application Delivery Controller (ADC), Message Archiver (BMA), WAF Control Center (WCC), Web Application Firewall (WAF), and Web Security Gateway (WSG). CISA: an authenticated administrator; this vulnerability can be chained with CVE-2026-116606. On those products the vendor marks 116606 as No, and Mandiant says 111560 needs administrative privileges. There is no pre-auth chain on the non-ESG products. Keep every KEV-listed product in scope.\n\nFixes disagree by source. Do not collapse them into one firmware. Vendor ESG patches: BNSF-40425 (9.4.017+) and BNSF-40430 (<9.4.017). Mandiant 116606: ESG < 9.4.0.030. Mandiant 111560: ESG <= 9.4.0.27. watchTowr (5 Nov 2026) compared 9.4.0.027 with 9.4.0.029 and tabulated Fixed In 9.4.0.029. Other 111560 patch IDs: BNADC-16586 (ADC and, per the vendor table, WAF), BNMA-32468, BNWF-60060, BNYF-24789. Confirm the vendor patch is installed on-device. Barracuda: the device shows the latest firmware available; appliances several versions behind may need more than one update; re-enable automatic patching if it was turned off.\n\nExploitation. CISA listed CVE-2026-116606 and CVE-2026-111560 in the Known Exploited Vulnerabilities catalog on 10 Nov 2026 (catalog 2026.11.10, released 2026-11-10T19:03:29.8375Z, 1,779 entries, dateAdded 2026-11-10, dueDate 2026-11-13). knownRansomwareCampaignUse Unknown. forensicTriage Yes. CWE-288 and CWE-78. CISA vulnerabilityName 116606: Barracuda Networks Email Security Gateway (ESG) Authentication Bypass Using an Alternate Path or Channel Vulnerability. CISA vulnerabilityName 111560: Barracuda Networks Multiple Products OS Command Injection Vulnerability. Under this site's method (https://vuln2shell.com/method), a KEV listing is confirmed exploitation evidence from CISA. It joins Barracuda's 9 Nov 2026, 9:00pm EST advisory update: \"We have identified exploitation activity affecting a small number of organizations.\" Barracuda's advisory still does not say which CVE or which product was exploited, and gives no victim count, actor, or IOCs. The KEV rows name both CVEs. SecurityOnline (10 Nov 2026) reads the vendor statement as the ESG chain, with CVE-2026-116606 exploited; that is a third-party reading. BleepingComputer (Sergiu Gatlan, 10 Nov 2026) reports the same vendor warning. Badge: Exploited in the wild (KEV). CISA has not described the activity it observed. CISA ADP SSVC Exploitation was none (timestamp 2026-11-02); that predates the 9 Nov vendor statement and the 10 Nov KEV listing. SecurityWeek (4 Nov 2026) wrote that neither advisory said whether the flaws had been exploited; that check is superseded. watchTowr / Sina Kheirkhah published a 5 Nov 2026 lab write-up titled as pre-auth remote root RCE, plus a Detection Artefact Generator (repo created 3 Nov 2026). Checked 10 Nov 2026: the repository's own interface takes an operator-supplied command, so this page indexes it on /pocs for defenders. This site does not copy usage or payloads. No Metasploit or Nuclei module confirmed as of 6 Nov 2026. PoC badge: Public PoC (unverified RCE).\n\nCredit: Barracuda, Mandiant, watchTowr / Sina Kheirkhah. Mandiant: Barracuda reported 111560 on 15 Oct 2026 and 116606 on 22 Oct 2026.","attackPath":{"caption":"High-level only. Not a reproduction guide. No request, handler, payload, or field-level mechanics. On ESG the chain is pre-auth. CISA KEV says CVE-2026-111560 can be chained with CVE-2026-116606 and needs an authenticated administrator. On the other listed products, 111560 still needs authenticated admin access.","steps":[{"id":"reach","label":"Reach the admin UI","detail":"The administrative interface is reachable. Barracuda: 116606 needs no login, but the Admin UI must be accessible."},{"id":"app","label":"Authorization bypass","detail":"CVE-2026-116606 (ESG only). Privileged configuration access without authenticating. Conceptual impact class only."},{"id":"unsafe","label":"Unsafe config processing","detail":"CVE-2026-111560. Crafted configuration is later processed. CISA KEV (catalog 2026.11.10) lists this OS command injection for ESG, Load Balancer, ADC, Message Archiver (BMA), WAF Control Center (WCC), WAF, and Web Security Gateway (WSG), and says it can be chained with CVE-2026-116606. On ADC, Message Archiver, WAF Control Center, WAF, and Web Security Gateway this step still needs an authenticated administrator."},{"id":"exec","label":"Commands as root","detail":"Mandiant: OS commands execute with root privileges when that configuration is processed."},{"id":"shell","label":"Device root","detail":"Barracuda: used together, the issues can bypass authorization controls and obtain root access to the device."}]},"exploitation":{"kev":{"listed":true,"date":"2026-11-10","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","note":"CISA listed CVE-2026-116606 (Barracuda Networks Email Security Gateway (ESG) Authentication Bypass Using an Alternate Path or Channel Vulnerability) and CVE-2026-111560 (Barracuda Networks Multiple Products OS Command Injection Vulnerability) on 10 Nov 2026, due 13 Nov 2026. Catalog 2026.11.10 (released 2026-11-10T19:03:29.8375Z, 1,779 entries). knownRansomwareCampaignUse Unknown. forensicTriage Yes. CWE-288 and CWE-78. This listing joins Barracuda's 9 Nov 2026 in-the-wild statement. Barracuda's advisory still does not name a CVE or product; the KEV rows name both CVEs. CISA has not named victims, a first-seen day, or IOCs. Verified 10 Nov 2026."},"firstSeen":{"date":"2026-11-09","source":"Barracuda advisory update 9 Nov 2026, 9:00pm EST","note":"Barracuda: \"We have identified exploitation activity affecting a small number of organizations.\" That is the 9 Nov 2026, 9:00pm EST advisory update, not a first calendar day of exploitation. Barracuda's advisory still does not say which CVE or which product was exploited, and gives no victim count, actor, or IOCs. CISA listed both CVE-2026-116606 and CVE-2026-111560 in KEV on 10 Nov 2026 (catalog 2026.11.10, due 13 Nov 2026), which names both CVEs. CISA has not named victims or IOCs.","dateLabel":"Vendor stated"},"vendorStatements":[{"vendor":"CISA","date":"2026-11-10","statement":"CISA KEV catalog 2026.11.10 (released 2026-11-10T19:03:29.8375Z, 1,779 entries) lists CVE-2026-116606 and CVE-2026-111560. vulnerabilityName 116606: Barracuda Networks Email Security Gateway (ESG) Authentication Bypass Using an Alternate Path or Channel Vulnerability. vulnerabilityName 111560: Barracuda Networks Multiple Products OS Command Injection Vulnerability. dateAdded 2026-11-10. dueDate 2026-11-13. knownRansomwareCampaignUse Unknown. forensicTriage Yes. CWE-288 and CWE-78. CISA has not named victims, a first-seen day, or IOCs.","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","retracted":false},{"vendor":"Barracuda","date":"2026-11-09","statement":"We have identified exploitation activity affecting a small number of organizations.","url":"https://trust.barracuda.com/security/pre-authentication-authorization-bypass-command-injection","retracted":false},{"vendor":"Barracuda","date":"2026-11-05","statement":"Authentication is not required to exploit this vulnerability; however, exploitation requires the administrative user interface (Admin UI) to be accessible to the attacker.","url":"https://trust.barracuda.com/security/pre-authentication-authorization-bypass-command-injection","retracted":false},{"vendor":"Barracuda","date":"2026-11-02","statement":"If exploited in combination, these vulnerabilities could allow an attacker to bypass authorization controls and obtain root access to the device.","url":"https://trust.barracuda.com/security/pre-authentication-authorization-bypass-command-injection","retracted":false},{"vendor":"Mandiant","date":"2026-11-02","statement":"An authentication bypass in Barracuda Email Security Gateway versions earlier than 9.4.0.030 allows an unauthenticated remote attacker to invoke a configuration-import function and restore a crafted, compatible backup archive, resulting in unauthorized modification of the appliance's global configuration.","url":"https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2026/MNDT-2026-0042.md","retracted":false}],"attributionDispute":"Barracuda's 9 Nov 2026 advisory still does not say which CVE or which product was exploited, and gives no victim count, actor, or IOCs. CISA KEV listed both CVE-2026-116606 and CVE-2026-111560 on 10 Nov 2026 (catalog 2026.11.10). SecurityOnline (10 Nov 2026) had already read the vendor statement as the ESG chain; that is a third-party reading. The KEV rows name both CVEs."},"timeline":[{"date":"2026-10-15","event":"Mandiant: Barracuda reported CVE-2026-111560.","source":{"title":"MNDT-2026-0041","url":"https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2026/MNDT-2026-0041.md","publisher":"Mandiant"},"kind":"disclosure","addedDate":"2026-11-05"},{"date":"2026-10-22","event":"Mandiant: Barracuda reported CVE-2026-116606.","source":{"title":"MNDT-2026-0042","url":"https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2026/MNDT-2026-0042.md","publisher":"Mandiant"},"kind":"disclosure","addedDate":"2026-11-05"},{"date":"2026-11-02","event":"Barracuda published the pre-authentication authorization bypass and command injection advisory. Patches listed for ESG, ADC, Message Archiver, WAF Control Center, WAF, and Web Security Gateway.","source":{"title":"Pre-Authentication Authorization Bypass and Command Injection Vulnerabilities in Certain Barracuda Products","url":"https://trust.barracuda.com/security/pre-authentication-authorization-bypass-command-injection","publisher":"Barracuda"},"kind":"advisory","key":true,"addedDate":"2026-11-05"},{"date":"2026-11-02T12:59:03Z","event":"Mandiant published CVE-2026-111560 and MNDT-2026-0041. CWE-78. CVSS 4.0 8.6. ESG <=9.4.0.27 and five other products.","source":{"title":"CVE-2026-111560","url":"https://www.cve.org/CVERecord?id=CVE-2026-111560","publisher":"Mandiant"},"kind":"advisory","key":true,"addedDate":"2026-11-05"},{"date":"2026-11-02T12:59:11Z","event":"Mandiant published CVE-2026-116606 and MNDT-2026-0042. CWE-288. CVSS 4.0 9.3. ESG <9.4.0.030.","source":{"title":"CVE-2026-116606","url":"https://www.cve.org/CVERecord?id=CVE-2026-116606","publisher":"Mandiant"},"kind":"advisory","key":true,"addedDate":"2026-11-05"},{"date":"2026-11-02","event":"CISA ADP SSVC for both CVEs: Exploitation none. Automatable yes for 116606, no for 111560. Technical Impact total.","source":{"title":"CVE-2026-116606 CISA ADP container","url":"https://cveawg.mitre.org/api/cve/CVE-2026-116606","publisher":"CISA ADP"},"kind":"other","addedDate":"2026-11-05"},{"date":"2026-11-03","event":"BleepingComputer reports the Barracuda warning and reprints the vendor product and patch table. The article does not describe in-the-wild use.","source":{"title":"Barracuda warns of critical flaws allowing root access to devices","url":"https://www.bleepingcomputer.com/news/security/barracuda-warns-of-critical-flaws-allowing-root-access-to-devices/","publisher":"BleepingComputer"},"kind":"other","addedDate":"2026-11-05"},{"date":"2026-11-03","event":"Centre for Cybersecurity Belgium published a warning. Patch with highest priority after testing. Restrict the administration interface to trusted networks.","source":{"title":"Warning: Authorization bypass and command injection in Barracuda Email Security Gateway and other Barracuda products","url":"https://ccb.belgium.be/advisories/warning-authorization-bypass-and-command-injection-barracuda-email-security-gateway-and","publisher":"CCB Belgium"},"kind":"other","addedDate":"2026-11-05"},{"date":"2026-11-03","event":"watchTowr Labs created the public Detection Artefact Generator repository for CVE-2026-116606 and CVE-2026-111560. Linked from Detection only.","source":{"title":"watchTowr-vs-Barracuda-RCE-CVE-2026-116606-CVE-2026-111560","url":"https://github.com/watchtowrlabs/watchTowr-vs-Barracuda-RCE-CVE-2026-116606-CVE-2026-111560","publisher":"watchTowr"},"kind":"other","addedDate":"2026-11-05"},{"date":"2026-11-04","event":"SecurityWeek reports the chain and notes that neither advisory says whether the flaws have been exploited. The 4 Nov article still reflects the pre-update advisory wording on authentication.","source":{"title":"Barracuda ESG Authentication Bypass Flaw Opens Path to Root","url":"https://www.securityweek.com/barracuda-email-security-gateway-authentication-bypass-opens-path-to-root/","publisher":"SecurityWeek"},"kind":"other","addedDate":"2026-11-05"},{"date":"2026-11-04","event":"Not in CISA KEV. Catalog 2026.11.04, released 2026-11-04T20:00:05.774Z. Rechecked 5 Nov 2026. Neither CVE has a catalog row.","source":{"title":"CISA Known Exploited Vulnerabilities catalog","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","publisher":"CISA"},"kind":"other","key":false,"addedDate":"2026-11-05"},{"date":"2026-11-05","event":"Barracuda updated the advisory at 2:30pm EST. CVE-2026-116606 Authentication Required changed from Yes, administrative access to No (Administrative UI Access Required).","source":{"title":"Pre-Authentication Authorization Bypass and Command Injection Vulnerabilities in Certain Barracuda Products","url":"https://trust.barracuda.com/security/pre-authentication-authorization-bypass-command-injection","publisher":"Barracuda"},"kind":"vendor","key":true,"addedDate":"2026-11-05"},{"date":"2026-11-05","event":"watchTowr / Sina Kheirkhah published the ESG lab write-up and pointed defenders at the Detection Artefact Generator. Compared 9.4.0.027 with 9.4.0.029.","source":{"title":"Barracuda Networks is your new best friend (Barracuda Email Security Gateway Pre-Auth Remote Root RCE CVE-2026-116606 / CVE-2026-111560)","url":"https://labs.watchtowr.com/barracuda-networks-is-your-new-best-friend-barracuda-email-security-gateway-pre-auth-remote-root-rce-cve-2026-116606-cve-2026-111560/","publisher":"watchTowr"},"kind":"disclosure","key":true,"addedDate":"2026-11-05"},{"date":"2026-11-09","event":"Barracuda updated the advisory at 9:00pm EST: \"We have identified exploitation activity affecting a small number of organizations.\" Barracuda does not say which CVE or which product was exploited, and gives no victim count, actor, or IOCs.","source":{"title":"Pre-Authentication Authorization Bypass and Command Injection Vulnerabilities in Certain Barracuda Products","url":"https://trust.barracuda.com/security/pre-authentication-authorization-bypass-command-injection","publisher":"Barracuda"},"kind":"exploited","key":true,"addedDate":"2026-11-10"},{"date":"2026-11-09","event":"Historical check: against KEV catalog 2026.11.09 (released 2026-11-09T19:54:37.4945Z, 1,773 entries; rechecked 10 Nov 2026, before the 2026.11.10 release), CVE-2026-116606 and CVE-2026-111560 were not listed. Superseded by the 10 Nov 2026 listing below.","source":{"title":"CISA Known Exploited Vulnerabilities catalog","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","publisher":"CISA"},"kind":"other","key":false,"addedDate":"2026-11-10"},{"date":"2026-11-10","event":"SecurityOnline reads Barracuda's 9 Nov statement as the ESG chain, with CVE-2026-116606 exploited. That is a third-party reading only.","source":{"title":"Barracuda ESG Vulnerability Exploited, PoC Exploit Public","url":"https://securityonline.info/barracuda-esg-vulnerability-exploited-poc/","publisher":"SecurityOnline"},"kind":"reported","addedDate":"2026-11-10"},{"date":"2026-11-10","event":"Checked the watchTowr Detection Artefact Generator repository: its own interface takes an operator-supplied command. Indexed on /pocs for defenders. This site does not copy usage or payloads.","source":{"title":"watchTowr-vs-Barracuda-RCE-CVE-2026-116606-CVE-2026-111560","url":"https://github.com/watchtowrlabs/watchTowr-vs-Barracuda-RCE-CVE-2026-116606-CVE-2026-111560","publisher":"watchTowr"},"kind":"poc","addedDate":"2026-11-10"},{"date":"2026-11-10","event":"CISA added CVE-2026-116606 (Barracuda Networks Email Security Gateway (ESG) Authentication Bypass Using an Alternate Path or Channel Vulnerability) and CVE-2026-111560 (Barracuda Networks Multiple Products OS Command Injection Vulnerability) to the Known Exploited Vulnerabilities catalog (catalog 2026.11.10, released 2026-11-10T19:03:29.8375Z, 1,779 entries). dateAdded 2026-11-10, dueDate 2026-11-13. knownRansomwareCampaignUse Unknown. forensicTriage Yes. CWE-288 and CWE-78. CISA has not described the activity it observed.","source":{"title":"CISA Known Exploited Vulnerabilities catalog","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","publisher":"CISA"},"kind":"kev","key":true,"addedDate":"2026-11-10"},{"date":"2026-11-10","event":"BleepingComputer (Sergiu Gatlan) reports Barracuda's warning that attackers have begun exploiting the two ESG flaws. Relays the 9 Nov vendor statement. The article does not mention CISA KEV.","source":{"title":"Hackers now exploit critical Barracuda ESG flaws to gain root access","url":"https://www.bleepingcomputer.com/news/security/hackers-exploit-barracuda-email-security-gateway-flaws-to-get-root-access/","publisher":"BleepingComputer"},"kind":"reported","addedDate":"2026-11-10"}],"openNotes":[{"title":"Affected and fixed versions disagree by source","detail":"Vendor ESG patches are BNSF-40425 (9.4.017+) and BNSF-40430 (<9.4.017). Mandiant lists ESG <9.4.0.030 for 116606 and ESG <=9.4.0.27 for 111560. watchTowr compared 9.4.0.027 with 9.4.0.029 and tabulated Fixed In 9.4.0.029. This page shows each with its source. Confirm the vendor patch is installed on-device. Do not treat any one firmware string as the only fix.","sources":[{"url":"https://trust.barracuda.com/security/pre-authentication-authorization-bypass-command-injection","date":"2026-11-05","publisher":"Barracuda"},{"url":"https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2026/MNDT-2026-0042.md","date":"2026-11-02","publisher":"Mandiant"},{"url":"https://labs.watchtowr.com/barracuda-networks-is-your-new-best-friend-barracuda-email-security-gateway-pre-auth-remote-root-rce-cve-2026-116606-cve-2026-111560/","date":"2026-11-05","publisher":"watchTowr"}]},{"title":"Advisory authentication wording changed on 5 Nov 2026","detail":"Barracuda updated the advisory at 2:30pm EST on 5 Nov 2026. CVE-2026-116606 Authentication Required changed from Yes, administrative access to No (Administrative UI Access Required). SecurityWeek's 4 Nov article still reflects the earlier wording. This page uses the 5 Nov vendor text.","sources":[{"url":"https://trust.barracuda.com/security/pre-authentication-authorization-bypass-command-injection","date":"2026-11-05","publisher":"Barracuda"},{"url":"https://www.securityweek.com/barracuda-email-security-gateway-authentication-bypass-opens-path-to-root/","date":"2026-11-04","publisher":"SecurityWeek"}]},{"title":"watchTowr DAG takes an operator-supplied command; listed on /pocs for defenders","detail":"Checked 10 Nov 2026 against the public watchTowr repository: the README and code take an operator-supplied command. This page indexes that repo on /pocs, labelled for defenders. This site does not copy usage or payloads. SecurityOnline (10 Nov 2026) calls it a public exploit; that is a third-party reading of the same repo interface. No Metasploit or Nuclei module was confirmed as of 6 Nov 2026. PoC badge: Public PoC (unverified RCE).","sources":[{"url":"https://github.com/watchtowrlabs/watchTowr-vs-Barracuda-RCE-CVE-2026-116606-CVE-2026-111560","date":"2026-11-10","publisher":"watchTowr"},{"url":"https://labs.watchtowr.com/barracuda-networks-is-your-new-best-friend-barracuda-email-security-gateway-pre-auth-remote-root-rce-cve-2026-116606-cve-2026-111560/","date":"2026-11-05","publisher":"watchTowr"},{"url":"https://securityonline.info/barracuda-esg-vulnerability-exploited-poc/","date":"2026-11-10","publisher":"SecurityOnline"}]},{"title":"Vendor advisory still does not name a CVE or product; KEV lists both","detail":"Barracuda's 9 Nov 2026 advisory still does not say which CVE or which product was exploited, and gives no victim count, actor, or IOCs. CISA KEV listed both CVE-2026-116606 and CVE-2026-111560 on 10 Nov 2026 (catalog 2026.11.10). SecurityOnline (10 Nov 2026) had already read the vendor statement as the ESG chain; that is a third-party reading. The KEV rows name both CVEs.","sources":[{"url":"https://trust.barracuda.com/security/pre-authentication-authorization-bypass-command-injection","date":"2026-11-09","publisher":"Barracuda"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2026-11-10","publisher":"CISA"},{"url":"https://securityonline.info/barracuda-esg-vulnerability-exploited-poc/","date":"2026-11-10","publisher":"SecurityOnline"}]}],"defenderActions":[{"title":"Apply the vendor patch and confirm it on-device","detail":"ESG: BNSF-40425 (9.4.017+) or BNSF-40430 (<9.4.017). ADC and WAF: BNADC-16586. Message Archiver: BNMA-32468. WAF Control Center: BNWF-60060. Web Security Gateway: BNYF-24789. Barracuda: verify latest firmware and that every security patch is applied. The device shows the latest firmware available. Appliances several versions behind may need more than one update.","priority":"now","links":[{"label":"Barracuda advisory","href":"https://trust.barracuda.com/security/pre-authentication-authorization-bypass-command-injection"}]},{"title":"Restrict the admin UI to trusted networks","detail":"Barracuda: organizations whose administrative interfaces are not publicly accessible from the internet are less exposed. Restrict access to trusted internal networks.","priority":"now","links":[{"label":"Barracuda advisory","href":"https://trust.barracuda.com/security/pre-authentication-authorization-bypass-command-injection"}]},{"title":"Re-enable automatic patching where it was turned off","detail":"Barracuda: if a patch has not been automatically applied, apply it manually. If automatic patching was turned off, set devices to receive patches automatically.","priority":"now","links":[{"label":"Barracuda advisory","href":"https://trust.barracuda.com/security/pre-authentication-authorization-bypass-command-injection"}]},{"title":"Hunt historically exposed ESG Admin UIs; do not only patch","detail":"CISA KEV marks forensic triage required (forensicTriage Yes; due 13 Nov 2026 for FCEB agencies). If an ESG Admin UI was reachable from the internet before patching, hunt that device for compromise, not just patch. Barracuda has published no IOCs. Hunt restore and configuration audit logs and unexpected temporary files from that window. A hit is a lead, not proof.","priority":"now","links":[{"label":"CISA KEV catalog","href":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog"},{"label":"Barracuda advisory","href":"https://trust.barracuda.com/security/pre-authentication-authorization-bypass-command-injection"},{"label":"MNDT-2026-0042","href":"https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2026/MNDT-2026-0042.md"}]}],"detection":[{"title":"Admin UI or reverse-proxy access from non-admin networks","detail":"Hunt connections to the administrative interface from networks that should not reach it. Barracuda: the Admin UI must be accessible for 116606. A hit is a lead for exposure, not proof of a bypass.","logSource":"Admin UI and reverse-proxy access logs","kind":"generic","group":"web-proxy","url":"https://trust.barracuda.com/security/pre-authentication-authorization-bypass-command-injection","date":"2026-11-05"},{"title":"Unexpected configuration or restore changes","detail":"Mandiant describes unauthorized global-configuration change via a restore, and command injection when crafted configuration is later processed. Hunt configuration and restore audit logs for unexpected configuration or restore changes. A hit is a lead, not proof.","logSource":"Appliance configuration and restore audit logs","kind":"generic","url":"https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2026/MNDT-2026-0042.md","date":"2026-11-02"},{"title":"Unexpected temporary files near that access","detail":"Hunt unexpected temporary files that line up with non-admin-network access or unexpected configuration or restore changes. A file hit is a lead, not proof. Do not treat a lab filename from a public write-up as an IOC.","logSource":"Host file inventory and appliance temporary-file telemetry","kind":"generic","group":"edr","url":"https://github.com/watchtowrlabs/watchTowr-vs-Barracuda-RCE-CVE-2026-116606-CVE-2026-111560","date":"2026-11-05"},{"title":"No public Sigma, Nuclei, or vendor signature","detail":"None public as of 6 Nov 2026. Do not invent a rule from the advisory. Use the log-source pointers above. The watchTowr Detection Artefact Generator is indexed on /pocs for defenders; it is not a signature pack.","logSource":"Public rule indexes (Nuclei, Sigma) and vendor signature bulletins","kind":"generic","date":"2026-11-06","dateKind":"checked"}],"detectionRules":[],"detectionLinks":[{"title":"watchTowr Detection Artefact Generator for CVE-2026-116606 / CVE-2026-111560","url":"https://github.com/watchtowrlabs/watchTowr-vs-Barracuda-RCE-CVE-2026-116606-CVE-2026-111560","author":"Sina Kheirkhah, watchTowr","date":"2026-11-03","note":"Public repo created 3 Nov 2026. Checked 10 Nov 2026: the repository's own interface takes an operator-supplied command. Indexed on /pocs for defenders. Do not run it against hosts you do not own. This site does not copy requests or payloads."}],"amIAffected":{"summary":"ESG is in scope for both CVEs when the admin UI is reachable. CISA KEV lists CVE-2026-111560 for Email Security Gateway (ESG), Load Balancer, Application Delivery Controller (ADC), Message Archiver (BMA), WAF Control Center (WCC), Web Application Firewall (WAF), and Web Security Gateway (WSG). On those products Mandiant says 111560 needs administrative privileges. Version strings disagree by source. Inventory the firmware and the vendor patch ID on-device. Do not send test requests to the admin UI.","checks":[{"id":"v2s-aia-barracuda-esg-auth-bypass-cve-2026-116606-version-1","kind":"version","title":"Record the on-device firmware and vendor patch IDs","detail":"Barracuda: the device shows the latest firmware version available. Record that string and whether BNSF-40425, BNSF-40430, BNADC-16586, BNMA-32468, BNWF-60060, or BNYF-24789 is installed. This is inventory only. Do not send a restore or configuration test.","command":"Record the firmware version and installed security-patch IDs shown on the appliance, then compare them to the vendor table: ESG BNSF-40425 (9.4.017+) or BNSF-40430 (<9.4.017); ADC and WAF BNADC-16586; Message Archiver BNMA-32468; WAF Control Center BNWF-60060; Web Security Gateway BNYF-24789.","affectedMeans":"The appliance is a listed product and the matching vendor patch ID is not shown as installed.","fixedMeans":"The matching vendor patch ID is shown as installed on-device, or the product is not in the vendor table.","notes":"Mandiant and watchTowr firmware strings disagree with each other and with the vendor patch IDs. The on-device patch ID is the check. Do not collapse those sources into one firmware.","sources":[{"url":"https://trust.barracuda.com/security/pre-authentication-authorization-bypass-command-injection","date":"2026-11-05","publisher":"Barracuda"}]},{"id":"v2s-aia-barracuda-esg-auth-bypass-cve-2026-116606-config-2","kind":"config","title":"Record whether automatic patching is on","detail":"Barracuda: if automatic patching was turned off, set devices to receive patches automatically. Record that setting. Do not use a crafted restore as a test.","command":"Record whether the appliance is set to receive patches automatically, and whether any listed security patch is waiting to be applied.","affectedMeans":"Automatic patching is off, or a listed patch is present and not applied.","fixedMeans":"Automatic patching is on and the listed patch IDs show as applied, or the product is not installed.","notes":"Automatic patching is not a substitute for confirming the patch ID on-device.","sources":[{"url":"https://trust.barracuda.com/security/pre-authentication-authorization-bypass-command-injection","date":"2026-11-05","publisher":"Barracuda"}]},{"id":"v2s-aia-barracuda-esg-auth-bypass-cve-2026-116606-config-3","kind":"config","title":"Record who can reach the admin UI","detail":"Barracuda: 116606 needs no login, but the Admin UI must be accessible. Record whether networks other than trusted admin networks can complete a connection to that interface. Do not authenticate or submit configuration as a test.","command":"Record the management-interface ACLs or edge rules that govern the administrative UI, and whether any non-admin network can complete a connection to it.","affectedMeans":"A listed appliance is unpatched and the admin UI is reachable from a network that is not a trusted admin network.","fixedMeans":"Only trusted admin networks can reach the admin UI (workaround), or the vendor patch is installed on-device.","notes":"Network limits are a workaround, not a software fix. Still apply the vendor patch.","sources":[{"url":"https://trust.barracuda.com/security/pre-authentication-authorization-bypass-command-injection","date":"2026-11-05","publisher":"Barracuda"}]}],"limits":["No sourced Shodan or Censys fingerprint. Do not invent a port or banner.","Version strings disagree by source. Confirm the vendor patch on-device.","Do not send a crafted restore, upload, or configuration change as a test.","On ADC, Message Archiver, WAF Control Center, WAF, and Web Security Gateway, 111560 still needs authenticated admin access."],"sources":[{"url":"https://trust.barracuda.com/security/pre-authentication-authorization-bypass-command-injection","date":"2026-11-05","publisher":"Barracuda"},{"url":"https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2026/MNDT-2026-0042.md","date":"2026-11-02","publisher":"Mandiant"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2026-11-10","publisher":"CISA"}],"updatedAt":"2026-11-10","addedDate":"2026-11-05"},"mitigations":{"summary":"Barracuda documents two workarounds until the patch is confirmed on-device: restrict administrative interfaces to trusted internal networks, and re-enable automatic patching. Neither replaces the vendor patch.","items":[{"title":"Restrict administrative interfaces to trusted internal networks","detail":"Barracuda: organizations whose administrative interfaces are not publicly accessible from the internet are less exposed. Restrict access to trusted internal networks and use network access controls to limit exposure.","limits":"Not a software fix. A reachable admin UI on an unpatched ESG remains in scope for the pre-auth chain. Still apply the vendor patch.","verify":"Untrusted networks can no longer complete a connection to the administrative interface. Confirm at the edge or management ACL, then re-check after the next change window. Do not send a restore or configuration test.","source":{"url":"https://trust.barracuda.com/security/pre-authentication-authorization-bypass-command-injection","date":"2026-11-05","publisher":"Barracuda"}},{"title":"Re-enable automatic patching and apply any waiting patch","detail":"Barracuda: if a patch has not been automatically applied, apply it manually. If automatic patching was turned off, set devices to receive patches automatically.","limits":"Automatic patching still needs an on-device check that the listed patch ID is present. Appliances several versions behind may need more than one update.","verify":"Automatic patching is on, and the listed patch ID for that product shows as installed on-device. Re-check after the next firmware window.","source":{"url":"https://trust.barracuda.com/security/pre-authentication-authorization-bypass-command-injection","date":"2026-11-05","publisher":"Barracuda"}}],"updatedAt":"2026-11-05","addedDate":"2026-11-05"},"response":{"summary":"CISA KEV marks forensic triage required. If a listed appliance had a reachable admin UI while unpatched, treat it as exposed. If an ESG Admin UI was reachable from the internet before patching, hunt that device for compromise, not just patch. Apply the vendor patch, restrict the admin UI, and review restore and configuration audit logs plus unexpected temporary files from that window. Barracuda has published no IOCs. No sourced persistence paths were published.","containment":[{"title":"Apply the vendor patch and confirm it on-device","detail":"ESG BNSF-40425 or BNSF-40430. ADC and WAF BNADC-16586. Message Archiver BNMA-32468. WAF Control Center BNWF-60060. Web Security Gateway BNYF-24789.","sources":[{"url":"https://trust.barracuda.com/security/pre-authentication-authorization-bypass-command-injection","date":"2026-11-05","publisher":"Barracuda"}]},{"title":"Restrict the admin UI to trusted networks","detail":"Barracuda workaround until the patch is confirmed.","sources":[{"url":"https://trust.barracuda.com/security/pre-authentication-authorization-bypass-command-injection","date":"2026-11-05","publisher":"Barracuda"}]},{"title":"Review unexpected configuration or restore changes","detail":"Hunt unexpected configuration or restore changes, admin-UI access from non-admin networks, and unexpected temporary files that line up with that access. A hit is a lead, not proof.","sources":[{"url":"https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2026/MNDT-2026-0042.md","date":"2026-11-02","publisher":"Mandiant"},{"url":"https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2026/MNDT-2026-0041.md","date":"2026-11-02","publisher":"Mandiant"}]},{"title":"Forensic triage on historically exposed ESG Admin UIs","detail":"CISA KEV forensicTriage Yes. If the ESG Admin UI was internet-reachable before the vendor patch, hunt unexpected configuration or restore changes, admin-UI access from non-admin networks, and unexpected temporary files from that window. A hit is a lead, not proof.","sources":[{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2026-11-10","publisher":"CISA"},{"url":"https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2026/MNDT-2026-0042.md","date":"2026-11-02","publisher":"Mandiant"}]}],"rotate":[{"item":"Appliance admin credentials and any secrets stored on a historically exposed device","reason":"Successful use can change global configuration and run commands as root. Rotate admin credentials on appliances whose admin UI was reachable while unpatched. Generic IR; no vendor credential list was published.","generic":true,"sources":[{"url":"https://trust.barracuda.com/security/pre-authentication-authorization-bypass-command-injection","date":"2026-11-05","publisher":"Barracuda"}]}],"evidence":[{"title":"On-device firmware and patch IDs from before the upgrade","detail":"Keep the firmware string and patch IDs so you can show whether the vendor patch was missing.","sources":[{"url":"https://trust.barracuda.com/security/pre-authentication-authorization-bypass-command-injection","date":"2026-11-05","publisher":"Barracuda"}]},{"title":"Admin UI and reverse-proxy access logs","detail":"Keep logs covering connections to the administrative interface from non-admin networks during the exposure window.","sources":[{"url":"https://trust.barracuda.com/security/pre-authentication-authorization-bypass-command-injection","date":"2026-11-05","publisher":"Barracuda"}]},{"title":"Configuration and restore audit logs","detail":"Keep records of unexpected configuration or restore changes from the exposure window. No sourced persistence path was published.","sources":[{"url":"https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2026/MNDT-2026-0042.md","date":"2026-11-02","publisher":"Mandiant"}]}],"limits":["Barracuda has published no IOCs.","No sourced persistence paths were published.","Barracuda's 9 Nov 2026 advisory still does not say which CVE or which product was exploited, and gives no victim count, actor, or IOCs. CISA KEV listed both CVEs on 10 Nov 2026.","The watchTowr DAG is indexed on /pocs for defenders. This site does not copy usage or payloads."],"sources":[{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2026-11-10","publisher":"CISA"},{"url":"https://trust.barracuda.com/security/pre-authentication-authorization-bypass-command-injection","date":"2026-11-09","publisher":"Barracuda"},{"url":"https://www.bleepingcomputer.com/news/security/hackers-exploit-barracuda-email-security-gateway-flaws-to-get-root-access/","date":"2026-11-10","publisher":"BleepingComputer"},{"url":"https://securityonline.info/barracuda-esg-vulnerability-exploited-poc/","date":"2026-11-10","publisher":"SecurityOnline"},{"url":"https://www.securityweek.com/barracuda-email-security-gateway-authentication-bypass-opens-path-to-root/","date":"2026-11-04","publisher":"SecurityWeek"}],"updatedAt":"2026-11-10","addedDate":"2026-11-05"},"bulletins":[],"coverage":[{"title":"Pre-Authentication Authorization Bypass and Command Injection Vulnerabilities in Certain Barracuda Products","publisher":"Barracuda","url":"https://trust.barracuda.com/security/pre-authentication-authorization-bypass-command-injection","date":"2026-11-02","type":"vendor","addedDate":"2026-11-05"},{"title":"MNDT-2026-0042","publisher":"Mandiant","url":"https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2026/MNDT-2026-0042.md","date":"2026-11-02","type":"research","addedDate":"2026-11-05"},{"title":"MNDT-2026-0041","publisher":"Mandiant","url":"https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2026/MNDT-2026-0041.md","date":"2026-11-02","type":"research","addedDate":"2026-11-05"},{"title":"CVE-2026-116606","publisher":"Mandiant / CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-116606","date":"2026-11-02","type":"vendor","addedDate":"2026-11-05"},{"title":"CVE-2026-111560","publisher":"Mandiant / CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-111560","date":"2026-11-02","type":"vendor","addedDate":"2026-11-05"},{"title":"Barracuda warns of critical flaws allowing root access to devices","publisher":"BleepingComputer","url":"https://www.bleepingcomputer.com/news/security/barracuda-warns-of-critical-flaws-allowing-root-access-to-devices/","date":"2026-11-03","type":"news","addedDate":"2026-11-05"},{"title":"Warning: Authorization bypass and command injection in Barracuda Email Security Gateway and other Barracuda products","publisher":"CCB Belgium","url":"https://ccb.belgium.be/advisories/warning-authorization-bypass-and-command-injection-barracuda-email-security-gateway-and","date":"2026-11-03","type":"government","addedDate":"2026-11-05"},{"title":"Barracuda ESG Authentication Bypass Flaw Opens Path to Root","publisher":"SecurityWeek","url":"https://www.securityweek.com/barracuda-email-security-gateway-authentication-bypass-opens-path-to-root/","date":"2026-11-04","type":"news","addedDate":"2026-11-05"},{"title":"Barracuda Networks is your new best friend (Barracuda Email Security Gateway Pre-Auth Remote Root RCE CVE-2026-116606 / CVE-2026-111560)","publisher":"watchTowr","url":"https://labs.watchtowr.com/barracuda-networks-is-your-new-best-friend-barracuda-email-security-gateway-pre-auth-remote-root-rce-cve-2026-116606-cve-2026-111560/","date":"2026-11-05","type":"research","addedDate":"2026-11-05"},{"title":"CISA KEV catalog JSON (CVE-2026-116606 and CVE-2026-111560 not listed; catalog 2026.11.04)","publisher":"CISA","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2026-11-04","type":"government","addedDate":"2026-11-05"},{"title":"Barracuda ESG Vulnerability Exploited, PoC Exploit Public","publisher":"SecurityOnline","url":"https://securityonline.info/barracuda-esg-vulnerability-exploited-poc/","date":"2026-11-10","type":"news","addedDate":"2026-11-10"},{"title":"CISA KEV catalog JSON (historical check: CVE-2026-116606 and CVE-2026-111560 not listed; catalog 2026.11.09, superseded by 2026.11.10)","publisher":"CISA","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2026-11-09","type":"government","addedDate":"2026-11-10"},{"title":"CISA KEV catalog JSON (CVE-2026-116606 and CVE-2026-111560 listed; catalog 2026.11.10)","publisher":"CISA","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2026-11-10","type":"government","addedDate":"2026-11-10"},{"title":"Hackers now exploit critical Barracuda ESG flaws to gain root access","publisher":"BleepingComputer","url":"https://www.bleepingcomputer.com/news/security/hackers-exploit-barracuda-email-security-gateway-flaws-to-get-root-access/","date":"2026-11-10","type":"news","addedDate":"2026-11-10"}],"posts":[],"research":[{"title":"MNDT-2026-0042","url":"https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2026/MNDT-2026-0042.md","authors":"Mandiant","date":"2026-11-02"},{"title":"MNDT-2026-0041","url":"https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2026/MNDT-2026-0041.md","authors":"Mandiant","date":"2026-11-02"},{"title":"Barracuda Networks is your new best friend (Barracuda Email Security Gateway Pre-Auth Remote Root RCE CVE-2026-116606 / CVE-2026-111560)","url":"https://labs.watchtowr.com/barracuda-networks-is-your-new-best-friend-barracuda-email-security-gateway-pre-auth-remote-root-rce-cve-2026-116606-cve-2026-111560/","authors":"Sina Kheirkhah, watchTowr","date":"2026-11-05"}],"impact":{"kind":"single-product","product":"Barracuda Email Security Gateway (ESG)","versions":[{"version":"ESG (vendor patches): BNSF-40425 for 9.4.017+, BNSF-40430 for <9.4.017. Both CVE-2026-116606 and CVE-2026-111560. Confirm the patch is installed on-device.","status":"affected","versions":"BNSF-40425 / BNSF-40430","vendorStatement":{"date":"2026-11-05","url":"https://trust.barracuda.com/security/pre-authentication-authorization-bypass-command-injection","quote":"Customers should review the affected products and remediation guidance below, ensure their systems are running the latest firmware version, and have all security patches applied."},"addedDate":"2026-11-05"},{"version":"ESG per Mandiant CVE-2026-116606: versions earlier than 9.4.0.030. Confirm the vendor patch is installed on-device. Do not treat 9.4.0.030 as the only fix string.","status":"affected","versions":"See vendor patch BNSF-40425 / BNSF-40430","vendorStatement":{"date":"2026-11-02","url":"https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2026/MNDT-2026-0042.md","quote":"Barracuda Email Security Gateway (ESG) < 9.4.0.030"},"addedDate":"2026-11-05"},{"version":"ESG per Mandiant CVE-2026-111560: versions <= 9.4.0.27. Confirm the vendor patch is installed on-device.","status":"affected","versions":"See vendor patch BNSF-40425 / BNSF-40430","vendorStatement":{"date":"2026-11-02","url":"https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2026/MNDT-2026-0041.md","quote":"Barracuda Email Security Gateway (ESG) <= 9.4.0.27"},"addedDate":"2026-11-05"},{"version":"ESG per watchTowr (5 Nov 2026): compared 9.4.0.027 (vulnerable) with 9.4.0.029. watchTowr table: Fixed In 9.4.0.029. Confirm the vendor patch is installed on-device.","status":"affected","versions":"watchTowr tabulated 9.4.0.029; confirm vendor patch on-device","vendorStatement":{"date":"2026-11-05","url":"https://labs.watchtowr.com/barracuda-networks-is-your-new-best-friend-barracuda-email-security-gateway-pre-auth-remote-root-rce-cve-2026-116606-cve-2026-111560/","quote":"Vulnerable: Barracuda ESG 9.4.0.027. Different: Barracuda ESG 9.4.0.029."},"addedDate":"2026-11-05"},{"version":"CISA KEV CVE-2026-111560 (Multiple Products, listed 10 Nov 2026): Email Security Gateway (ESG), Load Balancer, Application Delivery Controller (ADC), Message Archiver (BMA), WAF Control Center (WCC), Web Application Firewall (WAF), and Web Security Gateway (WSG). CISA: authenticated administrator; can be chained with CVE-2026-116606. Confirm the vendor patch is installed on-device. Keep every listed product in scope.","status":"affected","versions":"See vendor patch IDs on-device","vendorStatement":{"date":"2026-11-10","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","quote":"Barracuda Networks Email Security Gateway (ESG), Load Balancer, Application Delivery Controller (ADC), Message Archiver (BMA), WAF Control Center (WCC), Web Application Firewall (WAF), and Web Security Gateway (WSG) contain an OS command injection vulnerability."},"addedDate":"2026-11-10"},{"version":"Load Balancer ADC (CVE-2026-111560 only; authenticated admin). Vendor patch BNADC-16586. Mandiant: <= 6.4.0. Confirm the patch is installed on-device.","status":"affected","versions":"BNADC-16586","vendorStatement":{"date":"2026-11-02","url":"https://trust.barracuda.com/security/pre-authentication-authorization-bypass-command-injection","quote":"Successful exploitation requires an attacker to have access to the administrative interface of an affected product."},"addedDate":"2026-11-05"},{"version":"Message Archiver (CVE-2026-111560 only; authenticated admin). Vendor patch BNMA-32468. Mandiant: <= 5.5.4.0. Confirm the patch is installed on-device.","status":"affected","versions":"BNMA-32468","vendorStatement":{"date":"2026-11-02","url":"https://trust.barracuda.com/security/pre-authentication-authorization-bypass-command-injection","quote":"Successful exploitation requires an attacker to have access to the administrative interface of an affected product."},"addedDate":"2026-11-05"},{"version":"WAF Control Center (CVE-2026-111560 only; authenticated admin). Vendor patch BNWF-60060. Mandiant: <= 2.2.1. Confirm the patch is installed on-device.","status":"affected","versions":"BNWF-60060","vendorStatement":{"date":"2026-11-02","url":"https://trust.barracuda.com/security/pre-authentication-authorization-bypass-command-injection","quote":"Successful exploitation requires an attacker to have access to the administrative interface of an affected product."},"addedDate":"2026-11-05"},{"version":"Web Application Firewall (CVE-2026-111560 only; authenticated admin). Vendor patch BNADC-16586 (same ID the vendor lists for ADC). Mandiant: <= 11.0.1. Confirm the patch is installed on-device.","status":"affected","versions":"BNADC-16586","vendorStatement":{"date":"2026-11-02","url":"https://trust.barracuda.com/security/pre-authentication-authorization-bypass-command-injection","quote":"Successful exploitation requires an attacker to have access to the administrative interface of an affected product."},"addedDate":"2026-11-05"},{"version":"Web Security Gateway (CVE-2026-111560 only; authenticated admin). Vendor patch BNYF-24789. Mandiant: <= 16.1.100.100. Confirm the patch is installed on-device.","status":"affected","versions":"BNYF-24789","vendorStatement":{"date":"2026-11-02","url":"https://trust.barracuda.com/security/pre-authentication-authorization-bypass-command-injection","quote":"Successful exploitation requires an attacker to have access to the administrative interface of an affected product."},"addedDate":"2026-11-05"}]},"pocs":[{"title":"watchTowr Detection Artefact Generator for CVE-2026-116606 / CVE-2026-111560 (for defenders)","url":"https://github.com/watchtowrlabs/watchTowr-vs-Barracuda-RCE-CVE-2026-116606-CVE-2026-111560","source":"Sina Kheirkhah, watchTowr","validationStatus":"unverified","validationDate":null,"listedDate":"2026-11-03","notes":"Checked 10 Nov 2026 against the public repository: the README and code take an operator-supplied command. Labelled for defenders. This site does not copy usage or payloads. SecurityOnline (10 Nov 2026) calls it a public exploit; that third-party reading is noted only as matching the repo's own interface. Not a vuln2shell validation.","addedDate":"2026-11-10"}],"pocEmptyState":"No other public PoC indexed as of 10 Nov 2026. The watchTowr Detection Artefact Generator is listed above for defenders. This site does not copy exploit code.","_feed":{"page":"https://vuln2shell.com/vulns/barracuda-esg-auth-bypass-cve-2026-116606","json":"https://vuln2shell.com/vulns/barracuda-esg-auth-bypass-cve-2026-116606.json","iocsCsv":"https://vuln2shell.com/vulns/barracuda-esg-auth-bypass-cve-2026-116606/iocs.csv","stix":"https://vuln2shell.com/vulns/barracuda-esg-auth-bypass-cve-2026-116606/stix.json","badges":{"patch":"Patched","itw":"Exploited in the wild","poc":"Public PoC (unverified RCE)"}}}