I have seen this pattern too many times: a security appliance that is supposed to protect the network becomes the easiest way into it. That is where Barracuda’s Email Security Gateway sits this week. Two flaws chain into root access with no login at all, a full technical breakdown is already public, and as of yesterday the common scanners check for it too. If you run one of these gateways, do not queue this for next week.<\/p>\n
Barracuda published its advisory on November 2, covering two flaws. The first, CVE-2026-116606, scored 9.3, is a pre-authentication authorization bypass in the Email Security Gateway, or ESG. It lets a remote attacker restore a crafted configuration backup without authorization. The second, CVE-2026-111560, scored 8.6, is an operating system command injection in the timezone setting, in code shared across Barracuda’s appliance line. Barracuda states that combined, they let an attacker bypass authorization and gain root access.<\/p>\n
Here is what changed the urgency. The first advisory listed administrative access as required. On November 5 Barracuda revised that to say authentication is not required \u2014 only network access to the administrative interface. That same day, watchTowr published a full analysis built by comparing patched and unpatched code. In plain terms: a failed password change does not stop the request, a backup restore stays reachable, and a timezone value in that backup is later passed to a helper running as root. One crafted restore can turn into a root command.<\/p>\n
The bypass affects ESG only. The command injection reaches six products in total: ESG, Load Balancer ADC, Web Application Firewall, Message Archiver, WAF Control Center, and Web Security Gateway. On those other five, an attacker still needs a working admin login first, which makes ESG the urgent one and the rest a close second.<\/p>\n
Then came yesterday’s step. A Nuclei scanner detection template for this flaw was proposed on November 6 and merged into the public library on November 8. Scanning stops being specialist work then \u2014 anyone can find gateways that answer.<\/p>\n
Serious, but I will not overstate it. As of November 8 and 9, no source I read reports exploitation in the wild, and neither flaw is in CISA’s Known Exploited Vulnerabilities catalog. CISA’s assessment inside the CVE records, dated November 2, reads exploitation “none” \u2014 but it also rates the bypass as automatable with total technical impact. That combination is exactly the window you want to close in: public analysis, public detection, no confirmed attacks yet, and very little skill needed once scanning starts.<\/p>\n
Reach matters more than the score. Both flaws sit behind the web administration interface. An ESG whose admin interface answers from the internet is the exposure that matters. An admin interface that only answers on a management network or VPN is a much smaller target, though not a safe one \u2014 anything compromised inside the network can still reach it.<\/p>\n
This product has history, which is why I say hunt as well as patch. In 2023, a different ESG flaw was exploited as a zero-day, and Barracuda told customers compromised appliances must be replaced regardless of patch version. Nothing links that campaign to this pair. The lesson is narrower: email gateways sit on the internet, see every inbound message, and run with broad privileges. A patch closes the hole from now on. It does not prove nobody used it first.<\/p>\n
First, close the door today, before you schedule anything else. Block the admin interface from the internet at your firewall, restrict it to your management network or VPN, and set the Administrator IP range on the appliance. If a provider manages it for you, allow only that provider’s fixed addresses. Mail ports are expected on an email gateway. Admin ports are not.<\/p>\n
Second, patch, and verify the patch, not just the firmware number. For ESG, the target is firmware 9.4.0.030 or later, with patch BNSF-40425 applied \u2014 or BNSF-40430 on firmware below 9.4.0.017. Check under ADVANCED, then Firmware Update, confirm the patch is listed as applied, and turn automatic patching back on if someone turned it off. Appliances several versions behind may need staged updates. For the other products, the patches are BNADC-16586 for Load Balancer ADC and Web Application Firewall, BNMA-32468 for Message Archiver, BNWF-60060 for WAF Control Center, and BNYF-24789 for Web Security Gateway.<\/p>\n
Third, look backwards. Take a configuration backup now, in case the current configuration is evidence. Then check for a restore nobody on your team ran, especially one preceded by a failed password change from an unfamiliar address. Review admin logins and configuration changes in the logs, and who reached the admin interface from outside. If you find a restore you cannot explain, treat the gateway as compromised, not merely unpatched.<\/p>\n
Fourth, review who holds admin access on every Barracuda box, and rotate shared, reused, or default credentials. On the five products where the injection still needs a login, credential hygiene is the difference between a flaw and a rooted box.<\/p>\n
My bottom line: re-triage this today if your team filed it on November 2 as an admin-only problem. It is not. It is a no-login path to root on an internet-facing email gateway, scanners found it yesterday, and the fix is already out. Patch it, lock the admin interface down, and check whether anyone got there first.<\/p>\n
Sources: ThreatDefence, “CVE-2026-116606 Barracuda ESG: Patching and Threat Hunting” (published November 4, updated November 9, 2026) \u2014 threatdefence.com\/article\/barracuda-esg-cve-2026-116606-patching-hunting<\/a>; Suriq, “Barracuda ESG CVE-2026-116606: Pre-Auth Root RCE Chain” (November 2026) \u2014 suriq.io\/blog\/barracuda-esg-cve-2026-116606-preauth-root-chain<\/a>, summarizing Barracuda’s advisory (November 2, revised November 5, 2026) and watchTowr Labs’ analysis (November 5, 2026).<\/p>\n","protected":false},"excerpt":{"rendered":" I have seen this pattern too many times: a security appliance that is supposed to protect the network becomes the easiest way into it. That is where Barracuda’s Email Security Gateway sits this week. Two flaws chain into root access with no login at all, a full technical breakdown is already public, and as of […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[8],"tags":[],"class_list":["post-187","post","type-post","status-publish","format-standard","hentry","category-security"],"_links":{"self":[{"href":"https:\/\/quentinpidcock.com\/content\/wp-json\/wp\/v2\/posts\/187","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/quentinpidcock.com\/content\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/quentinpidcock.com\/content\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/quentinpidcock.com\/content\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/quentinpidcock.com\/content\/wp-json\/wp\/v2\/comments?post=187"}],"version-history":[{"count":0,"href":"https:\/\/quentinpidcock.com\/content\/wp-json\/wp\/v2\/posts\/187\/revisions"}],"wp:attachment":[{"href":"https:\/\/quentinpidcock.com\/content\/wp-json\/wp\/v2\/media?parent=187"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/quentinpidcock.com\/content\/wp-json\/wp\/v2\/categories?post=187"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/quentinpidcock.com\/content\/wp-json\/wp\/v2\/tags?post=187"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}