# Barracuda: restrict administration access and apply security patches Canonical: https://www.oktsec.com/radar/barracuda-esg-administration-exploitation Publisher: Oktsec Language: en Published: 2026-11-11T13:37:53Z Updated: 2026-11-11T13:37:53Z Record reviewed: 2026-11-11T13:37:53Z Latest evidence check: 2026-11-11T13:37:53Z Disclosed: 2026-11-02 Barracuda confirms exploitation affecting a small number of organizations. ESG has both flaws; the command injection also affects other listed appliances, with different authentication requirements. ## Evidence and response priority - Category: Vulnerability - Oktsec priority: Act now - Rationale: Barracuda confirms exploitation and CISA lists both CVEs in KEV. Reachable ESG administration interfaces are the immediate concern; other products have separate prerequisites. - Evidence: Attacks confirmed - Verification: Vendor confirmed - Fix status: Fix available - Exposure requirement: Application or configuration dependent - Vendor: Barracuda - Products: Email Security Gateway, Load Balancer ADC, Message Archiver, WAF Control Center, Web Application Firewall, Web Security Gateway - CVEs: CVE-2026-116606, CVE-2026-111560 ## Technical overview CVE-2026-116606 bypasses authorization on ESG without credentials when the administrative interface is reachable. CVE-2026-111560 requires administrative access on its own. The combined ESG path can reach root; that chain must not be assumed for every listed product. The vendor corrected the authentication description on November 5 and confirmed exploitation on November 9. CISA added both CVEs on November 10. These dates do not establish when attacks began. Firmware and security patches are separate checks. Follow the product table rather than assuming the latest firmware alone completes remediation. ## Recommended response Restrict administration access to trusted networks, install the latest firmware and verify the applicable security patch. Investigate prior exposure separately from patching. Relevant to: Teams operating the Barracuda appliances listed in the affected systems table. ## CVE attribution - CVE-2026-116606: Barracuda — Email Security Gateway. [Source](https://trust.barracuda.com/security/pre-authentication-authorization-bypass-command-injection) - CVE-2026-111560: Barracuda — Email Security Gateway, Load Balancer ADC, Message Archiver, WAF Control Center, Web Application Firewall, Web Security Gateway. [Source](https://trust.barracuda.com/security/pre-authentication-authorization-bypass-command-injection) ## Affected systems and fixes ### Email Security Gateway (both CVEs) Affected: Appliances missing the applicable security patch; administration UI must be reachable. Fixed release / action: Latest firmware plus BNSF-40425 for 9.4.017+, or BNSF-40430 for older firmware. ### Load Balancer ADC (CVE-2026-111560) Affected: Appliances missing the patch; this command injection requires administrative access on its own. Fixed release / action: Latest firmware plus BNADC-16586. ### Message Archiver (CVE-2026-111560) Affected: Appliances missing the patch; this command injection requires administrative access on its own. Fixed release / action: Latest firmware plus BNMA-32468. ### WAF Control Center (CVE-2026-111560) Affected: Appliances missing the patch; this command injection requires administrative access on its own. Fixed release / action: Latest firmware plus BNWF-60060. ### Web Application Firewall (CVE-2026-111560) Affected: Appliances missing the patch; this command injection requires administrative access on its own. Fixed release / action: Latest firmware plus BNADC-16586. ### Web Security Gateway (CVE-2026-111560) Affected: Appliances missing the patch; this command injection requires administrative access on its own. Fixed release / action: Latest firmware plus BNYF-24789. Confirm the running version against the vendor advisory, including any distribution backports. ## CISA KEV evidence Catalog: 2026.11.10 Checked: 2026-11-11T13:38:13.699Z ### [CVE-2026-116606](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-116606) - Added: 2026-11-10 - Ransomware use: Not confirmed by CISA - Federal due date: 2026-11-13 - Federal forensic triage: Yes Action specified by CISA: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. ### [CVE-2026-111560](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-111560) - Added: 2026-11-10 - Ransomware use: Not confirmed by CISA - Federal due date: 2026-11-13 - Federal forensic triage: Yes Action specified by CISA: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. CISA KEV inclusion establishes known exploitation of the listed CVE, not compromise of your environment. Absence does not rule out exploitation. The date added is not the first attack date. Federal deadlines and forensic triage requirements are context, not universal obligations for private organizations or businesses in Latin America. ## Supporting evidence Snapshot checked: 2026-11-11T13:38:14.304Z. These dates do not change the incident’s editorial review date. ### FIRST EPSS forecast - [CVE-2026-116606](https://api.first.org/data/v1/epss?cve=CVE-2026-116606): 1.6% probability of observed exploitation in the next 30 days; percentile 76.03%; score date 2026-11-10. - [CVE-2026-111560](https://api.first.org/data/v1/epss?cve=CVE-2026-111560): 1.06% probability of observed exploitation in the next 30 days; percentile 64.83%; score date 2026-11-10. EPSS is a prediction, not exploitation evidence or organization-specific risk. Confirmed exploitation takes precedence. A missing score is not zero. Check status: available; last successful check: 2026-11-11T13:38:14.304Z. ## Response checklist 1. **Identify product and management exposure** — Record the exact appliance, firmware, patch status and networks that could reach its administrative interface. 2. **Verify firmware and security patches** — Use the vendor table for the exact product. If a patch did not apply automatically, install it manually and verify completion. 3. **Investigate earlier access** — Oktsec recommends preserving logs, checking unexpected administrative changes and involving incident response if compromise is suspected. Patching alone does not prove removal of persistence. ## Relevance to AI environments Oktsec recommends reviewing credentials and integrations reachable from a compromised appliance. These flaws are not specific to AI. ## Sources - [Barracuda: security advisory](https://trust.barracuda.com/security/pre-authentication-authorization-bypass-command-injection) — Barracuda; Vendor notice; checked 2026-11-11T13:37:53Z - [CISA KEV: exact CVE records](https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json) — CISA; Government advisory; checked 2026-11-11T13:37:53Z ## Editorial record - 2026-11-11T13:37:53Z: Added affected configurations, vendor corrections and confirmed exploitation evidence. ## Use this advisory in Radar Use the Advisory view to understand the issue and its evidence, Affected systems to compare versions, and Response plan to record applicability, an owner and action progress. Plans are saved only in the current browser and can be downloaded for sharing; they are not a shared team account or an automated scan. Completing a plan does not validate remediation. Talk to Oktsec opens a technical consultation with the advisory and selected service preserved. Scope, fees and access are agreed before any assessment. [Open advisory](https://www.oktsec.com/radar/barracuda-esg-administration-exploitation) · [Build a response plan](https://www.oktsec.com/radar/barracuda-esg-administration-exploitation#review-workspace) - [Exposure check consultation](https://www.oktsec.com/contact?source=radar&intent=assessment&item=barracuda-esg-administration-exploitation&service=exposure_check) - [Patch verification consultation](https://www.oktsec.com/contact?source=radar&intent=assessment&item=barracuda-esg-administration-exploitation&service=patch_verification) ## Scope and corrections Radar is a selected editorial collection, not a complete vulnerability database or a scan of your environment. Priorities are Oktsec analysis. Source confirmation and checklist completion do not establish whether your systems are compromised or secure. [Sources and methodology](https://www.oktsec.com/radar/about). Report corrections with supporting sources to info@oktsec.com. Do not send secrets or private incident data.