Barracuda email gateways are being hacked through the admin page: CISA adds CVE-2026-116606 and CVE-2026-111560 to its exploited list

Attackers are breaking into Barracuda Email Security Gateway appliances through the admin web page, and the end state is full control of the box that filters a company's mail. Barracuda confirmed the attacks late on November 9, and on November 10 CISA added both bugs, CVE-2026-116606 and CVE-2026-111560, to its Known Exploited Vulnerabilities catalog. Patch today, then check whether someone already got in, because the patch does not undo what an attacker changed.

We covered the chain when Barracuda disclosed it on November 2, back when nobody reported attacks: how the two bugs go from no login to root. This post is about what changed and what to do now that it is live.

What changed since November 2

• November 5: watchTowr Labs published a full technical write-up of the chain against ESG 9.4.0.027 and a detection tool, but no exploit. The same day Barracuda changed "Authentication Required" for CVE-2026-116606 from "Yes, administrative access" to "No (Administrative UI Access Required)". No password needed, only a route to the admin page.
• November 9, 9:00 PM EST: Barracuda updated its advisory: "We have identified exploitation activity affecting a small number of organizations." It has not said how many, or whether attackers reached root. Barracuda declined to give The Register a number.
• November 10: CISA added CVE-2026-116606 and CVE-2026-111560 to the KEV catalog (version 2026.11.10) with a due date of November 13. That is three days. The four other bugs CISA added the same day got until November 24. CISA also marked both Barracuda entries "Forensic Triage: Yes", which tells federal agencies to look for compromise, not just install the patch.

How to fix

Update the firmware from the appliance: ADVANCED > Firmware Update, click Update until it stops offering a newer build, reboot if asked, and read Current Installed Version again. Target 9.4.0.030 or later for the Email Security Gateway. The ESG patch IDs are BNSF-40425 on 9.4.017 and later and BNSF-40430 on older builds. Below 9.1 Barracuda says to update in two steps.

In the Firmware Patches section, set Apply Patches to Automatic. Barracuda's documentation lists Disable as the default, so a box nobody has touched since setup may be sitting on a patch it downloaded and never applied.

Then close the door the attack walks through. The ESG admin page listens on HTTP port 8000 by default. From outside your network, with your gateway's public address in place of 203.0.113.10:

curl --include --max-time 10 http://203.0.113.10:8000/

A status line such as HTTP/1.1 200 or 302 means the admin page is on the internet. Restrict it to a management network or VPN at your firewall. A timeout or refused connection is what you want.

Patching does not clean up a box that was already hit

This is the part most "patch now" notices skip. The bypass does not just log an attacker in. Per watchTowr's write-up, it lets a stranger upload a forged settings backup that the appliance restores as its global configuration. Barracuda signs those backups with a checksum, but the secret is a fixed string baked into the code, so anyone can forge a valid one. The root command rides in the time zone field of that restored config.

A firmware update fixes the code. It does not roll your configuration back. If someone restored their backup before you patched, their settings are still your settings. So after patching:

1. Read the time zone setting. It should be a plain zone name such as America/New_York or UTC. watchTowr's example payload starts with UTC followed by quotes and a hash sign. Anything with punctuation that is not part of a zone name is a red flag.
2. Compare the configuration against a backup you exported before November 2. Look hardest at admin accounts, which addresses may reach the admin page, and anything that controls where mail goes. A forged restore replaces all of it at once.
3. Search logs in front of the appliance. If a firewall or reverse proxy logs requests to the admin port, look for POST requests to /cgi-mod/index.cgi from addresses that are not your admins. The restore rides on a multipart POST to that path with the field pu_bayesian_upload set, according to watchTowr. Most logs will not show the form fields, so treat any unexplained outside POST there as worth a look.
4. If anything looks wrong, call Barracuda Support ([email protected]) before you rebuild. Barracuda says it worked directly with the affected organizations.

For context: in 2023, after CVE-2023-2868 was exploited, Barracuda told ESG customers to replace compromised appliances outright, because attackers had planted malware that survived updates. Barracuda has not said that this time. We would still treat a box with a tampered time zone or unknown admin as untrusted until Barracuda says otherwise.

Who is not in scope

• Load Balancer ADC, Web Application Firewall, Message Archiver, WAF Control Center and Web Security Gateway are only affected by CVE-2026-111560, which needs a real admin login. Patch them (BNADC-16586, BNMA-32468, BNWF-60060, BNYF-24789), but the no-login attack is ESG only.
• Barracuda's cloud email products are not in the advisory's affected list.
• An ESG whose admin page only answers on an internal management network is still vulnerable, but Barracuda calls it "less exposed": the attacker would already need to be inside.

What this is not

This is not an email-borne attack. Nobody can trigger it by sending you a message, unlike the 2023 .tar attachment bug. It needs a route to the admin web page. Barracuda has also not published how the attacks it saw played out, so "small number of organizations" is all anyone outside Barracuda knows today.

HOL Guard keeps the source record for this issue on the CVE-2026-116606 evidence pack. This post is the operator write-up.

What do people ask about the Barracuda ESG attacks?

Is CVE-2026-116606 being exploited?

Yes. Barracuda reported exploitation affecting a small number of organizations on November 9, 2026, and CISA added CVE-2026-116606 and CVE-2026-111560 to the Known Exploited Vulnerabilities catalog on November 10, 2026.

What is the CISA deadline?

November 13, 2026 for both CVEs. The deadline binds US federal civilian agencies, but it is a fair signal of how urgent CISA thinks this is for everyone.

Which firmware fixes it?

Email Security Gateway 9.4.0.030 or later, delivered as patch BNSF-40425 on 9.4.017 and later or BNSF-40430 on older builds. Install the newest build the appliance offers.

Does patching remove an attacker who already got in?

Not by itself. The attack restores a forged configuration, and a firmware update does not roll that back. Check the time zone setting, admin accounts and mail routing after you patch.

Do attackers need a password?

No. They need network access to the admin web page, which is port 8000 by default. Keeping that page off the internet is the strongest mitigation besides the patch.

References

• Barracuda Trust Center advisory (updated November 9, 2026 with exploitation activity)
• CISA Known Exploited Vulnerabilities catalog (2026.11.10)
• watchTowr Labs technical analysis of the chain
• The Register: Barracuda's email security gateways bitten by make-me-root vulns
• Mandiant MNDT-2026-0042 (CVE-2026-116606)
• Mandiant MNDT-2026-0041 (CVE-2026-111560)
• NVD: CVE-2026-116606
• NVD: CVE-2026-111560