Do first: Upgrade to a fixed version: 9.4.0.030.

  • Exploitation: none
  • Automatable: yes
  • Technical impact: total

Summary

The Barracuda Email Security Gateway appliance is affected. An unauthenticated remote attacker could bypass login protections and restore a crafted configuration backup, allowing unauthorized changes to the device's global settings.

Written by anthropic/claude-haiku-5.5 from the sources below. Verify against them.

An authentication bypass in Barracuda Email Security Gateway versions earlier than 9.4.0.030 allows an unauthenticated remote attacker to invoke a configuration-import function and restore a crafted, compatible backup archive, resulting in unauthorized modification of the appliance’s global configuration.

cve.now Index

  • Exploitation28/40Public exploit, and a Nuclei detection template
  • Exposure20/25No login or user action needed, CISA rates it automatable · Unknown: Advisories don't say whether default setups are affected
  • Reach?/20Unknown. No tracked technology or package matched
  • Severity10/10CVSS 9.3, total technical impact per CISA
  • No patch0/5No signal

What would change the score

  • Would score about 75 if added to CISA KEV
  • Would score about 70 if CISA's SSVC rates exploitation active
  • Would score about 63 if advisories confirm default setups are exposed

How the score works · Rankings

What to do

  • Upgrade to a fixed version: 9.4.0.030.

Upgrade to a fixed version: 9.4.0.030.

Check your systems with an agent

Paste this into a coding or ops agent. It checks your systems read-only and reports a table per asset.

Public exploit activity

Timeline

  1. Nov 2, 2026, 12:00 AM UTCCISA SSVC assessment

    Exploitation: none · Automatable: yes · Technical impact: total

  2. Nov 2, 2026, 12:59 PM UTCCVE published
  3. Nov 2, 2026, 1:07 PM UTCFirst seen by cve.now
  4. Nov 2, 2026, 1:19 PM UTCPosted on X by cve.now
  5. Nov 2, 2026, 2:02 PM UTCcve.now early warning

    Barracuda warns customers to patch two flaws enabling root command execution

    1 day
  6. Nov 3, 2026, 4:55 AM UTCRecord last updated3 days
  7. Nov 6, 2026, 2:03 AM UTCExploit code on GitHub

    watchtowrlabs/watchTowr-vs-Barracuda-RCE-CVE-2026-116606-CVE-2026-111560

Exploitation: none · Automatable: yes · Technical impact: total

Barracuda warns customers to patch two flaws enabling root command execution

watchtowrlabs/watchTowr-vs-Barracuda-RCE-CVE-2026-116606-CVE-2026-111560

Affected versions

  • Barracuda Networks Barracuda Email Security Gateway (ESG)

    fixed in 9.4.0.030

fixed in 9.4.0.030

On X 10

Barracuda Networks is your new best friend (CVE-2026-116606 / CVE-2026-111560) Enjoy our latest public research.... labs.watchtowr.com/barracuda-netw…

⚠️ Barracuda Email Security Gateway: probes targeting CVE-2026-116606 have reached our decoy honeypots. Evidence 👇 On 9 November, we recorded two requests from one source IP, 152.228.140[.]252. The requests use the disclosed authentication bypass request structure to try to reach the backup upload handler at /cgi-mod/index.cgi. Their poc.bak uploads contain only “not-a-tar” repeated ten times. These captures show targeted probing. They contain no timezone command injection payload for the related CVE-2026-111560, and do not establish successful exploitation. The requests resemble watchTowr’s published example, but differ from both its full generator and the published Nuclei template. The exact tool is unknown. A Nuclei check for CVE-2026-116606 is now available. Barracuda administrators should verify that the latest firmware and applicable security patches are installed, and restrict access to the administrative interface. More evidence below 👇

⚠️ Barracuda Email Security Gateway: CVE-2026-116606 config-import exploitation has been hitting our decoys since 6 November, 12:02 UTC. Several toolsets are now sending working payloads, and one operator went on to browse the admin backup pages. Evidence and IoC below👇

【技術解説】パスワード変更の「失敗」が未認証rootへの入口に──Barracuda ESGの2段連鎖 Barracuda ESGの未認証root連鎖が公開。CVE-2026-116606(9.3)はパスワード変更失敗時に低権限ロールを返す実装不備で、未認証のままバックアップ復元機能へ到達。復元データ内のタイムゾーン値がrootでシェル実行されCVE-2026-111560(8.6)に接続。整合性チェックサムの秘密値はハードコードで偽造可能。9.4.0.030へ。 #脆弱性 #メールセキュリティ #CVE

Barracudaのメールセキュリティゲートウェイなど6製品に、連鎖させるとroot権限を奪われる恐れがある脆弱性が2件出た。 ESGの認可回避のCVE-2026-116606（CVSS 9.3）と、6製品に共通するOSコマンドインジェクションのCVE-2026-111560（CVSS 8.6）だ。11月2日に公表され、パッチも配られている。 悪用には管理画面へのアクセスが必要とされている。運用の現場で手が止まるのはここだ。 パッチを当てる作業そのものは、保守の時間を取れば済む。時間を食うのは、その管理画面に今どこから届くのかを確かめる作業のほうだ。メール基盤は導入した部署、ネットワークの許可ルールは別の担当、リモート保守の経路はベンダー。持ち主が3つに割れている組織は珍しくない。 『管理画面へのアクセスが必要』という条件が効くのは、届く経路を全部言える組織だけだ。 パッチの日程を組む前に、管理画面に届く送信元を一覧にしろ。そこで詰まる組織は、次の脆弱性でも同じところで詰まる。

Not tagged in Shodan yet, so no count (not zero): SonicWall CVE-2026-19868, OpenSSH SSHole CVE-2026-123158, Barracuda ESG CVE-2026-116606.

📩 El equipo que protege tu correo también necesita que compruebes sus propias defensas. Una cadena de dos vulnerabilidades permite alcanzar root en Barracuda Email Security Gateway sin iniciar sesión, siempre que el atacante pueda acceder a su interfaz administrativa. 🔎 CVE-2026-116606 permite eludir controles de autorización. Combinada con CVE-2026-111560, abre la puerta a ejecutar comandos. El 5 de noviembre se publicó la demostración técnica. Hay evidencia de laboratorio; las fuentes consultadas no confirman ataques reales con esta cadena. 🛠️ Barracuda indica que ESG 9.4.0.029 incorpora las correcciones. Comprueba firmware y parches efectivos, y restringe la administración a redes confiables. 👀 Un detalle para quienes hacemos auditoría: el comprobador publicado puede ejecutar comandos y modificar el equipo. Hay que conocer sus efectos antes de utilizarlo. La seguridad también consiste en revisar las herramientas con las que verificamos la seguridad. 🔗 Aviso del fabricante: trust.barracuda.com/security/pre-a… #Ciberseguridad #B28

Tool fingerprints to hunt for: • UA "CVE-2026-116606-check/1.0" (active today) • UA "esg-scan" • boundary "----labBarracudaBoundary" • python-requests 2.31 / 2.32 • 4 DigitalOcean hosts firing within 9 s, same iPod UA • Tor exits

🔴 ثغرة في Barracuda Email Security Gateway: اثنتان من الثغرات تُسلسلان معًا = صلاحيات root كاملة بدون تسجيل دخول. الأولى: تجاوز مصادقة (CVE-2026-116606) الثانية: حقن أوامر (CVE-2026-111560) النتيجة: مهاجم يتحكم بالجهاز بالكامل. المصدر: The Hacker News

An email security gateway’s admin page shouldn’t become the easiest way into the network. Barracuda says two flaws—CVE-2026-116606 and CVE-2026-111560—can be chained to gain remote root access on an unpatched Email Security Gateway. The attacker needs access to the Admin UI, not a logged-in administrator. Apply the fixes, enable automatic patching, and restrict the Admin UI to trusted networks. These protections belong together. Is direct access to an admin page worth the exposure, or should private-network access be the default? #CyberSecurity #Barracuda #EmailSecurity

Evidence 6

Vendor advisory · 1

Establishes: Affected and fixed versions.

  1. Advisorytrust.barracuda.com · security/pre-authentication-authorization-bypass-command-injection

CVE record · 2

Establishes: The identifier and description.

  1. RecordCVE List · CVE-2026-116606
  2. RecordNVD · CVE-2026-116606

Public exploit code · 2

Establishes: Public exploit code exists (Exploit-DB, Metasploit, Nuclei and GitHub).

  1. ExploitGitHub · projectdiscovery/nuclei-templates · http/cves/2026/CVE-2026-116606.yaml
  2. ExploitGitHub · watchtowrlabs/watchTowr-vs-Barracuda-RCE-CVE-2026-116606-CVE-2026-111560 · Repository

Other links · 1

  1. RepositoryGitHub · mandiant/Vulnerability-Disclosures · 2026/MNDT-2026-0042.md

Corrections

None so far.

Something wrong on this page? Report an error. Every fix is listed here.

Questions about CVE-2026-116606

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. Public exploit code exists (a proof of concept on GitHub).Source: cve.now feed data

An attacker who is not logged in can get past the appliance's authentication and restore a crafted backup archive. That restore changes the appliance's global configuration without authorization.Source: github.com

Barracuda Email Security Gateway (ESG): before 9.4.0.030.Source: cve.now feed data

Barracuda Email Security Gateway versions earlier than 9.4.0.030 are affected. To check, look at the firmware or software version shown on the appliance's administration interface and compare it with 9.4.0.030.Source: github.com

Upgrade Barracuda Email Security Gateway to version 9.4.0.030 or later, which contains the fix. No workaround is listed in the facts.Source: github.com

Sources

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Related

More vulnerabilities