{"id":4158,"date":"2026-11-11T07:08:22","date_gmt":"2026-11-11T15:08:22","guid":{"rendered":"https:\/\/cyber.mag212.com\/barracuda-esg-cve-2026-116606-111560-exploited-root-six-appliances\/"},"modified":"2026-11-11T07:10:21","modified_gmt":"2026-11-11T15:10:21","slug":"barracuda-esg-cve-2026-116606-111560-exploited-root-six-appliances","status":"publish","type":"post","link":"https:\/\/cyber.mag212.com\/fr\/barracuda-esg-cve-2026-116606-111560-exploited-root-six-appliances\/","title":{"rendered":"Barracuda\u2019s Exploited Flaw Chain Gives Attackers Root on Six Appliance Lines; CISA Sets a 13 November Deadline"},"content":{"rendered":"\n

If a Barracuda appliance\u2019s administrative interface can be reached from the internet, assume someone has already tried it. Two flaws disclosed on 2 November, an authorization bypass in Email Security Gateway and a command injection shared by six product lines, chain together to give an unauthenticated attacker root. Barracuda confirmed exploitation on 9 November, and CISA added both CVEs to its Known Exploited Vulnerabilities (KEV) catalog the next day with a three-day deadline and an explicit instruction to look for compromise, not just patch.<\/p>\n\n\n\n

CVEs<\/strong><\/td>CVE-2026-116606 (9.3) \u00b7 CVE-2026-111560 (8.6)<\/td><\/tr>
Affected<\/strong><\/td>ESG, Load Balancer ADC, BMA, WCC, WAF, WSG<\/td><\/tr>
Condition<\/strong><\/td>Admin UI reachable; no credentials<\/td><\/tr>
IOCs<\/strong><\/td>None published<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

What happened<\/h2>\n\n\n\n

[Confirmed]<\/strong> Barracuda’s advisory covers an authorization bypass in Email Security Gateway only<\/strong> (CVE-2026-116606, CVSS 9.3) and a command injection in ESG, Load Balancer ADC, Message Archiver, WAF Control Center, WAF and Web Security Gateway<\/strong> (CVE-2026-111560, CVSS 8.6). Chained, they give root. On 9 November at 21:00 EST Barracuda added that it had seen exploitation “affecting a small number of organizations”. (Barracuda<\/a>) CISA added both to KEV on 10 November<\/strong>, due 13 November<\/strong>, with forensic triage “Yes”<\/strong>, ransomware use “Unknown” and references to Mandiant disclosures MNDT-2026-0041\/-0042. (CISA KEV<\/a>)<\/p>\n\n\n\n

[Reported]<\/strong> Previdian saw 17 attempts against CVE-2026-116606 from 15 IP addresses in three countries between 9 and 11 November; the IPs weren’t published and the actors are unidentified. No ransomware link has been reported. (SecurityWeek<\/a>) (Previdian<\/a>)<\/p>\n\n\n\n

\"Five-step
Figure 1 \u00b7 The Barracuda chain, as MAG212 reads it.<\/strong> Two CVEs chained to root. The middle step is MAG212’s inference from CISA’s two KEV descriptions, not a published walkthrough. Below: the six affected product lines. Diagram: MAG212 CYBER<\/figcaption><\/figure>\n\n\n\n

Who is affected and how it works<\/h2>\n\n\n\n
Product<\/th>CVE(s)<\/th>Patch ID<\/th>Product<\/th>CVE(s)<\/th>Patch ID<\/th><\/tr><\/thead>
ESG 9.4.017 and later<\/td>both<\/td>BNSF-40425<\/code><\/td>WAF Control Center<\/td>111560<\/td>BNWF-60060<\/code><\/td><\/tr>
ESG below 9.4.017<\/td>both<\/td>BNSF-40430<\/code><\/td>Web Application Firewall<\/td>111560<\/td>BNADC-16586<\/code><\/td><\/tr>
Load Balancer ADC<\/td>111560<\/td>BNADC-16586<\/code><\/td>Web Security Gateway<\/td>111560<\/td>BNYF-24789<\/code><\/td><\/tr>
Message Archiver<\/td>111560<\/td>BNMA-32468<\/code><\/td>Version thresholds given for ESG only [Unknown]<\/strong> fixed firmware for the others<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

Source: Barracuda advisory<\/a>.<\/em><\/p>\n\n\n\n

[Confirmed]<\/strong> On 5 November Barracuda changed CVE-2026-116606’s “Authentication Required” field to “No (Administrative UI Access Required)”: no credentials, but the admin UI must be reachable. (Barracuda<\/a>) KEV says the bypass lets an attacker invoke config-import and restore a crafted backup, and the injection runs root commands “when the crafted timezone value is subsequently processed”. (CISA KEV<\/a>) [MAG212 analysis]<\/strong> That points to a crafted backup that sets a malicious timezone value. [Unknown]<\/strong> Tooling, actors, start date and the Mandiant pages’ contents.<\/p>\n\n\n\n

What to look for<\/h2>\n\n\n\n

[MAG212 analysis]<\/strong> With no published IOCs: config-import or backup-restore events you didn’t start, unexpected timezone changes, and admin-UI connections from outside your management networks.<\/p>\n\n\n\n

Investigate, contain and remediate (in order)<\/h2>\n\n\n\n
    \n
  1. Restrict the admin UI now<\/strong> to trusted networks; this is Barracuda’s workaround. (Barracuda<\/a>)<\/li>\n\n\n
  2. Confirm the latest firmware and the patch ID<\/strong> on every device. Devices several versions behind may need more than one update; apply manually if auto-patching didn’t run. (Barracuda Campus<\/a>)<\/li>\n\n\n
  3. Triage before you trust a patched box.<\/strong> [MAG212 analysis]<\/strong> Treat any appliance with an internet-reachable admin UI since 2 November as possibly compromised: preserve logs, review config history, involve Barracuda support or your IR provider.<\/li>\n\n\n
  4. [MAG212 analysis]<\/strong> If compromise is suspected, rotate LDAP bind, SMTP relay and admin credentials, and consider rebuilding rather than cleaning.<\/li>\n\n<\/ol>\n\n\n\n

    Verify recovery:<\/strong> the patch ID shows as applied on every device; the admin UI doesn’t answer from an external vantage point; config history re-reviewed after patching. Lesson<\/strong> [MAG212 analysis]<\/strong>: MSPs should inventory admin-UI exposure across every client appliance this week.<\/p>\n\n\n\n

    Why it matters<\/h2>\n\n\n\n

    Email and web gateways sit on the boundary, hold relay and directory credentials, and see every message an organisation sends and receives. Barracuda ESG has been a target for state actors before, and appliances in small businesses, schools and MSP client estates are often patched automatically but rarely inspected. A patched box that was opened before the patch landed is still a compromised box.<\/p>\n\n\n\n

    The bottom line<\/h2>\n\n\n\n

    Restrict every Barracuda admin interface to trusted networks today, confirm the patch ID on each device rather than trusting auto-update, and treat any appliance whose admin UI was reachable since 2 November as a forensic case until its configuration history says otherwise.<\/p>\n\n\n\n

    How we label evidence: [Confirmed]<\/strong> comes from a primary source such as a vendor or CISA; [Reported]<\/strong> from a secondary outlet; [Claimed]<\/strong> from an attacker or an unverified party; [MAG212 analysis]<\/strong> is our judgement; [Unknown]<\/strong> means not established at press time. Commands and indicators are copied from the cited sources and were not tested by MAG212 CYBER.<\/em><\/p>\n\n\n\n

    \n\n\n\n

    This story is part of MAG212 CYBER Daily, 11 November 2026<\/a>, with the day\u2019s other verified stories, the Defender\u2019s Action Desk and a full source register. Get the daily briefing free: subscribe to MAG212 CYBER<\/a>. By El Mostafa Ouchen.<\/p>\n\n","protected":false},"excerpt":{"rendered":"

    Barracuda confirms exploitation of CVE-2026-116606 and CVE-2026-111560, which chain to root on Email Security Gateway and five other appliance lines. CISA wants fixes and forensic triage by 13 November. Affected products, patch IDs, what to look for and the order of response.<\/p>","protected":false},"author":1,"featured_media":4156,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[19,15,14],"tags":[197,62,299,30],"class_list":["post-4158","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-critical-cves","category-threat-intelligence","category-vulnerabilities","tag-barracuda","tag-cisa-kev","tag-email-security","tag-zero-day-vulnerabilities"],"_links":{"self":[{"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/posts\/4158","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/comments?post=4158"}],"version-history":[{"count":1,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/posts\/4158\/revisions"}],"predecessor-version":[{"id":4181,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/posts\/4158\/revisions\/4181"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/media\/4156"}],"wp:attachment":[{"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/media?parent=4158"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/categories?post=4158"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/tags?post=4158"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}