critical severityConfidence highHistorical record

Barracuda Email Security Gateway chained from no login to root through the admin interface (CVE-2026-116606, CVE-2026-111560)

Direct answer

Barracuda Email Security Gateway chained from no login to root through the admin interface (CVE-2026-116606, CVE-2026-111560), also tracked as CVE-2026-116606 / CVE-2026-111560 / MNDT-2026-0042 is a critical-severity threat campaign HOL Guard tracked from Oct 15, 2026 to Nov 2, 2026, verified against 8 primary sources and last reviewed Nov 2, 2026. Active tracking has ended and the record remains published as a permanent historical research record.

Barracuda and Mandiant disclosed two bugs on 2026-11-02. CVE-2026-116606 (CVSS 4.0 9.3, CWE-288) is an authentication bypass in Barracuda Email Security Gateway (ESG) that lets an unauthenticated remote attacker invoke the configuration-import function and restore a crafted, compatible backup, modifying the appliance's global configuration. CVE-2026-111560 (CVSS 4.0 8.6, CWE-78) is an OS command injection in the timezone configuration field that runs as root and needs administrator privileges; it affects ESG, Load Balancer ADC, Web Application Firewall, Web Security Gateway, Message Archiver and WAF Control Center. Barracuda says that exploited in combination they can bypass authorization controls and give root on the device, and that exploitation requires access to the administrative interface. Barracuda's Campus page names ESG firmware 9.4.0.029 as the fix; the CVE record and Mandiant list the bypass as affecting versions earlier than 9.4.0.030. Patch IDs: ESG BNSF-40425 (9.4.017+) and BNSF-40430 (older), ADC and WAF BNADC-16586, BMA BNMA-32468, WCC BNWF-60060, WSG BNYF-24789. No exploitation reported and not on CISA KEV as of catalog 2026.10.30.

Also tracked as CVE-2026-116606 · CVE-2026-111560 · MNDT-2026-0042 · MNDT-2026-0041 · Barracuda ESG authentication bypass config restore · Barracuda timezone command injection

First observed
Oct 15, 2026
Last observed
Nov 2, 2026
Last reviewed
Nov 2, 2026
Tracking ended
Nov 2, 2026

Record exports

JSON recordArtifact CSVSTIX 2.1 bundle

Uncertainty and limitations

Read the evidence limits before acting on this record.

Barracuda's Campus article says ESG 9.4.0.029 includes the patches, while the CVE record and Mandiant MNDT-2026-0042 say the bypass affects versions earlier than 9.4.0.030; HOL has not confirmed which build closes CVE-2026-116606. Barracuda's advisory summary lists 'Authentication Required: Yes, administrative access' for both CVEs while also calling CVE-2026-116606 pre-authentication and the CVE record scores it PR:N; HOL reads this as network access to the admin interface. Barracuda and Mandiant publish no technical details of the bypass path.

  • Barracuda Load Balancer ADC, WAF, WSG, Message Archiver and WAF Control Center are listed only for CVE-2026-111560, which needs administrator credentials.
  • Barracuda's cloud email products are not in the advisory's affected product list.
  • Exploitation requires access to the administrative interface; mail arriving on SMTP is not the stated entry point.
  • No public exploit, no in-the-wild exploitation report and no CISA KEV listing as of 2026-11-02 (catalog 2026.10.30).

Guard coverage and policy

What Guard's reviewed assertions do and do not claim for this campaign, and the reviewed starting points for defense.

Not covered, or partially covered

  • not covered

    HOL Guard reviews AI coding agent actions on developer machines. It does not patch or inspect Barracuda appliances; the fix is a firmware update and restricting admin interface access.

No campaign-specific policy guidance is published.

Safe next step. Campaign guidance is defensive context. It does not auto-apply policy or claim universal campaign coverage.

Open policy controlsCampaign-specific emergency policy starting point

Timeline

Reviewed events, oldest first, each tied to a verified source.

  1. Update

    Mandiant timeline: CVE-2026-111560 (timezone command injection) reported by Barracuda.

    Source:Mandiant MNDT-2026-0041 (CVE-2026-111560)

  2. Update

    Mandiant timeline: CVE-2026-116606 (ESG authentication bypass via configuration import) reported by Barracuda.

    Source:Mandiant MNDT-2026-0042 (CVE-2026-116606)

  3. Disclosure

    Barracuda publishes its Trust Center advisory and Campus remediation pages with patch IDs for ESG, ADC, BMA, WCC, WAF and WSG.

    Sources:Barracuda Trust Center: Pre-Authentication Authorization Bypass and Command Injection Vulnerabilities·Barracuda Campus: ESG remediation for CVE-2026-116606 and CVE-2026-111560

  4. Disclosure

    CVE records for CVE-2026-111560 and CVE-2026-116606 published alongside Mandiant advisories MNDT-2026-0041 and MNDT-2026-0042.

    Sources:CVE-2026-116606 CVE record·Mandiant MNDT-2026-0042 (CVE-2026-116606)·Mandiant MNDT-2026-0041 (CVE-2026-111560)

  5. Update

    HOL Guard publishes an operator write-up with the firmware check, the Firmware Patches default, the port 8000 exposure check and scope notes.

    Source:HOL: Barracuda Email Security Gateway no-login-to-root chain, fix and exposure check

Publication clock: 14.6 hours from reviewed disclosure timestamp to HOL publication; 12-hour critical target; historical backfill outside target.

Reviewed artifacts

The specific artifacts this record concerns, as reviewed. Names and versions are shown as text; a registry link is not recorded here.

  • Barracuda Email Security Gateway (ESG)@CVE-2026-116606: < 9.4.0.030 (CVE record); CVE-2026-111560: <= 9.4.0.27genericpackage
  • Barracuda Load Balancer ADC, WAF, WSG, Message Archiver, WAF Control Center@CVE-2026-111560 only: ADC <= 6.4.0, WAF <= 11.0.1, WSG <= 16.1.100.100, BMA <= 5.5.4.0, WCC <= 2.2.1genericpackage

Sources

Every claim on this record is traceable to the sources below.

Campaign questions, answered

Barracuda and Mandiant disclosed two bugs on 2026-11-02. CVE-2026-116606 (CVSS HOL Guard tracked the campaign from Oct 15, 2026 to Nov 2, 2026.

No. Active tracking ended Nov 2, 2026; this page remains as a labeled historical research record and does not imply the threat is currently active.

The record cites 8 primary sources, names 2 reviewed artifacts, and was last fully reviewed Nov 2, 2026 by HOL Guard Security Publishing. Its uncertainty and limitations are stated on the record itself.

Campaign guidance is defensive context. It does not auto-apply policy or claim universal campaign coverage.

The permalink above is permanent. The full record can be downloaded from this page as JSON, an artifact CSV, and a STIX 2.1 bundle, and corrections can be requested through the published correction path on the record. Barracuda's Campus article says ESG 9.4.0.029 includes the patches, while the CVE record and Mandiant MNDT-2026-0042 say the bypass affects versions earlier than 9.4.0.030; HOL has not confirmed which build closes CVE-2026-116606.

Reviewed in full by HOL Guard Security Publishing.

Published
Last full review
Last modified

Report a correction

Record HGTC-2026-6755147B