Barracuda ESG vulnerabilities patch versions — 9.4.0.030 shuts a no-login root path under attack

Two flaws in Barracuda Networks' Email Security Gateway (ESG) that together lead from no login to root are being used in real attacks. Barracuda disclosed CVE-2026-116606 and CVE-2026-111560 and shipped patches on November 2, 2026. At 9:00 p.m. US Eastern time on November 9 it added to the advisory that it had "identified exploitation activity affecting a small number of organizations." On November 10 the US Cybersecurity and Infrastructure Security Agency (CISA) placed both in its Known Exploited Vulnerabilities (KEV) catalog and gave federal agencies until November 13.

The ESG sits in front of a mail server and filters everything going in and out. Root on that box is a seat over an organization's entire mail flow. The same product was at the center of a 2023 zero-day, CVE-2023-2868, that ended with Barracuda telling customers to replace compromised appliances rather than patch them. This piece sets out which versions are fixed, what an attacker needs, what an administrator should check, and how this case differs from 2023.

1. Which versions are fixed — 9.4.0.030 for ESG, patch IDs for the rest

The two flaws have different reach. The authentication bypass, CVE-2026-116606, exists only in ESG. The command injection, CVE-2026-111560, lives in code shared across Barracuda appliances and affects six product lines.

Two cautions. First, Barracuda's advisory gives no fixed firmware build, only patch identifiers. Barracuda appliances receive security patches separately from firmware upgrades, so a firmware number alone does not prove a device is safe; the patch has to show as applied.

Second, the ESG threshold differs by one build depending on the source.

There is no need to pick a winner. Firmware 9.4.0.030 or later with the patch shown as applied satisfies all of them. A device sitting on 9.4.0.029 is inside the affected range in the CVE record for the bypass, so one more upgrade is the safe choice.

On severity: CVE-2026-116606 scores 9.3 and CVE-2026-111560 scores 8.6 under CVSS 4.0. Barracuda labels both "High," though 9.3 falls in the Critical band and the CVE record marks it so. watchTowr noted that a comment inside the patch file carries the figure 9.8.

2. How it works — a failed password change opens the door

The chain, per watchTowr's analysis and the CVE records, with exploit detail omitted:

Step 2 is CVE-2026-116606 and step 4 is CVE-2026-111560. The injection normally needs an administrator; on ESG the bypass supplies that position. That is why "root without a login" holds only on ESG. On the other five products, based on what is public, an attacker needs administrator access first. That is not a reason to wait: a stolen admin credential is then one step from root.

The authentication question changed in the advisory itself. On November 2 Barracuda listed administrative access as required for CVE-2026-116606. At 2:30 p.m. Eastern on November 5 it changed the field to "No (Administrative UI Access Required)." watchTowr published its chain analysis the same day, and BleepingComputer updated its report on November 6 to say attackers do not need admin privileges.

One condition remains: the attacker must be able to reach the admin interface. Barracuda says organizations that do not expose administrative interfaces to the internet are less exposed. An ESG that accepts mail from the internet but serves its admin pages only on an internal network cannot be hit directly from outside. An intruder already inside the network still can.

3. What to do now — checks and order of action

The menu paths in rows 2 to 5 follow a write-up by security firm ThreatDefence that cites Barracuda's support documentation; names may differ slightly by firmware.

Barracuda says to apply the patch by hand if it was not applied automatically. According to ThreatDefence, the documented default for the patch mode is "Disable," which lists patches without installing them. Assuming the device patched itself is the mistake to avoid; confirm it on screen.

Hunting is hard because Barracuda has published no indicators of compromise: no addresses, no file names. The following are leads derived from watchTowr's description of the flaws and ThreatDefence's hunting guidance, not vendor-confirmed indicators.

ThreatDefence suggests starting the search window at October 15, 2026, the earliest report date in Mandiant's timeline. If something suspicious turns up, its advice is to cut internet access to the admin interface, preserve a configuration backup and logs, contact Barracuda Support before rebuilding, and rotate every credential the appliance held.

CISA's own handling signals priority. Of the six entries added on November 10, four (Microsoft Outlook, Google Chromium, Cisco BroadWorks, Openwave) carry a November 24 due date and are not flagged for forensic triage. The two Barracuda entries are due November 13 and are flagged for it. The deadline binds only US federal civilian agencies, but it is a usable ranking for anyone.

4. How this differs from 2023 — the patch came before the attacks

Barracuda ESG carries weight with security teams because of 2023. CVE-2023-2868, identified that May, had been exploited for roughly seven months. On June 6, 2023 Barracuda issued a notice that "compromised ESG appliances must be immediately replaced regardless of patch version level" — a rare case of a security vendor telling customers to swap hardware.

The main difference is order. In 2023 the attackers were first and defenders learned of it about seven months later, by which time the intruders were embedded deeply enough that patching could not evict them. In 2026 Barracuda found and fixed the flaws first, and attacks were confirmed a week after the patch. These are attacks on a patched vulnerability, not a zero-day. Appliances that took the patch on time are not the target.

The second difference is path. The 2023 flaw sat in attachment processing, on a device whose job is to receive mail; there was nothing to close. This time the path runs through the admin interface, which can be kept off the internet.

That is not grounds for comfort. Attackers read patches too. Patch on November 2, detailed analysis and an exposure-check tool from watchTowr on November 5, confirmed exploitation on November 9: the gap between fix and attack was one week. Devices with automatic patching off, or with admin pages facing the internet, were the targets of that week. And as in 2023, a patch does not clean a device that has already given up root.

5. Other edge-device flaws from the same week

Fortinet published eight critical advisories on November 10. FortiManager and FortiAnalyzer manage configuration and logs for fleets of firewalls, so a compromise there reaches everything beneath. Fixed versions vary by advisory and some are listed as upcoming, so none are given here.

Cisco BroadWorks is a platform carriers use to run business telephony. SecurityWeek reports that Malbear Labs described on November 8 a campaign against a European telecommunications provider that used the flaw. A patch from August reached the exploited list three months later; set beside Barracuda's one week, it shows how unpredictable that gap is.

6. What remains unknown

• Scale. "A small number of organizations" is all Barracuda has said. No count, sector or region.
• Attacker. Neither Barracuda nor CISA has named one. Nothing public ties this to UNC4841.
• Whether the flaws were chained in the wild. The advisory says the combination could yield root; it does not describe the observed attacks. Previdian's 17 attempts targeted CVE-2026-116606, with no word on success.
• Indicators. None are official.
• The exact build. No Barracuda statement says whether 9.4.0.029 or 9.4.0.030 fully closes the bypass.
• Replacement. No such notice as of the November 9 revision; an ongoing investigation could change that.

For the rest of the week's patching, see our "November 2026 Patch Tuesday — why a 6.5-rated Outlook zero-day, CVE-2026-124194, comes first among 1,094 fixes"; its conclusion, that exploited beats high-scoring, applies here. Background is in "Zero-day explained" and "What CVSS is", and another no-login configuration-tampering case is covered in "Drupal Commerce CVE-2026-118539 patch".