Barracuda flaws exploited to root access as federal patch deadline lands today
Barracuda confirmed on November 9–10 that attackers are actively exploiting two recently patched Email Security Gateway flaws that chain into root access, and CISA added both to its Known Exploited Vulnerabilities catalog on November 10 with a federal remediation deadline of today, Friday, November 13. CVE-2026-116606, rated CVSS 9.3 by Barracuda, is a pre-authentication authorisation bypass in the gateway's admin interface; CVE-2026-111560, rated CVSS 8.6, is an operating-system command injection through a timezone configuration value, with injected commands running as root.
📊 Scorecard: our Bearish call on $CRWD is scored from $229.87, the last close before it ran. Its first result comes after the next close.
The News
Barracuda confirmed on November 9–10 that attackers are actively exploiting two recently patched Email Security Gateway, or ESG, flaws that chain into root access, and CISA added both to its Known Exploited Vulnerabilities catalog on November 10 with a federal remediation deadline of today, Friday, November 13. The catalog, known as KEV, is the US government's list of flaws that are known to be exploited in the wild, and federal agencies must fix listed flaws by the deadline given.
CVE-2026-116606, rated CVSS 9.3 by Barracuda, is a pre-authentication authorisation bypass in the ESG admin interface that lets an unauthenticated attacker invoke the configuration-import function and restore a crafted backup, rewriting the appliance's global configuration. No login is required, though the attacker must be able to reach the admin interface. CVE-2026-111560, rated CVSS 8.6, is an operating-system command injection through a timezone configuration value, with injected commands running as root — the highest privilege on the machine. The command-injection flaw also affects the Load Balancer ADC, Message Archiver, WAF Control Center, Web Application Firewall and Web Security Gateway.
Barracuda disclosed both flaws on November 2 with patches, including ESG firmware 9.4.0.030, under advisories BNSF-40425 and BNSF-40430. On November 9 it updated the advisory to say it had identified exploitation affecting a small number of organizations. Barracuda has not said how many organisations, how long attackers held the flaws, or what they did once inside. This is the second major ESG exploitation wave after the 2023 UNC4841 zero-days, when Barracuda told customers to physically replace appliances.
Two patched flaws, chained to root access, with the federal deadline landing today — and Barracuda still cannot say how many organisations are hit.
Why It Matters
An email security gateway sits in front of an organisation's mail, deciding what gets in. That position is exactly what makes it a target: compromise the gateway and you sit on the mail flow, able to read, redirect or forge messages. The chain here is what makes it dangerous. The first flaw needs no login at all — an attacker who can reach the admin interface can restore a crafted backup and rewrite the gateway's global configuration. The second flaw turns a timezone setting into a command line running as root. Together, they hand over the machine.
CVSS scores are worth understanding because they explain the urgency. The Common Vulnerability Scoring System rates flaws from 0 to 10, and anything above 9 is critical. Barracuda rates the bypass at 9.3; the US National Vulnerability Database lists 9.8 for the same flaw, a discrepancy worth noting because it shows even the scoring is contested. Either number means the same thing in practice: a severe, remotely reachable flaw with no login needed, and the only barrier is whether the attacker can reach the admin interface.
The deadline is the other half of the story. CISA's Known Exploited Vulnerabilities catalog is not a warning list — it is a list of flaws confirmed to be exploited, with a fix-by date for federal agencies. Today, November 13, is that date for both flaws. Federal agencies must comply; private organisations are not bound by it, but the exploitation does not distinguish between the two, and the catalog listing is the government's way of saying the threat is live, not theoretical.
The 2023 precedent is why Barracuda customers will be nervous. In the UNC4841 zero-day wave that year, Barracuda told customers to physically replace appliances — the damage was judged too deep for a software fix alone. This week's flaws are patched, not zero-days, and there is no replacement order. But the pattern — email gateways, active exploitation, unknown scope — is the same one, and until Barracuda says how many organisations are affected and what the attackers did inside, the comparison will hang over the story.
Analyst's Take
Our call is Bearish. Actively exploited flaws that chain to root access on email gateways are about as bad as a vulnerability story gets, and the unknowns make it worse: Barracuda has not said how many organisations are affected, how long attackers held the flaws, or what they did once inside. A patch has existed since November 2, yet exploitation is under way — which means the gap is not the fix, it is the patching. Barracuda is private, so the listed read-throughs are CrowdStrike and Palo Alto Networks, whose security-vendor shares move on the same threat headlines.
What to watch: whether Barracuda puts a number on affected organisations, whether exploitation spreads beyond the small number it has acknowledged, and how fast the remaining unpatched gateways get fixed. The 2023 precedent — physical appliance replacement — is the reminder that Barracuda's worst days do not end with a firmware update. Until the scope is known, every unpatched ESG with a reachable admin interface is an open door.
Are you bullish or bearish on this story?
By The Numbers
FAQ
What does chaining into root access mean?
The two flaws work together. The first lets an attacker with no login rewrite the gateway's global configuration; the second lets them run operating-system commands with root privileges — the highest level of access on the machine, able to do anything the system itself can do.
What is the CVSS score?
CVSS, the Common Vulnerability Scoring System, rates flaws from 0 to 10 by severity. Barracuda rates CVE-2026-116606 at 9.3 and CVE-2026-111560 at 8.6. Note that NVD, the US vulnerability database, lists 9.8 for CVE-2026-116606 — this story uses Barracuda's own 9.3 rating and notes the discrepancy.
Who has to patch by today?
CISA's Known Exploited Vulnerabilities catalog sets a remediation deadline of Friday, November 13 for federal agencies. Private organisations are not bound by that deadline, but the same flaws and the same active exploitation apply to them.
Which products are affected?
The Email Security Gateway, plus the Load Balancer ADC, Message Archiver, WAF Control Center, Web Application Firewall and Web Security Gateway for the command-injection flaw. Barracuda disclosed both flaws on November 2 with patches, including ESG firmware 9.4.0.030.
Has this happened to Barracuda before?
Yes. This is the second major ESG exploitation wave after the 2023 UNC4841 zero-days, when Barracuda told customers to physically replace appliances. The 2023 incident is the reason this week's news lands so hard with Barracuda customers.
👁
Source: BleepingComputer