Exploited Barracuda ESG auth bypass and root command injection flaws land on CISA KEV with Nov 13 deadline

What happened

The Hacker News reported on November 6 that researchers demonstrated chainable high-severity flaws in Barracuda Email Security Gateway (ESG), and watchTowr released a tool that checks whether an appliance is affected ^[1].

Barracuda updated its advisory on the evening of November 9 (EST) to say exploitation of the authorization bypass CVE-2026-116606 and the command injection CVE-2026-111560 has been identified, affecting a small number of organizations; chained, they allow bypassing authorization and gaining root on the device, provided the attacker can reach the administrative interface ^[2][3].

Affected products

CVE-2026-116606 affects Email Security Gateway; CVE-2026-111560 also affects Load Balancer ADC, Message Archiver, WAF Control Center, Web Application Firewall and Web Security Gateway ^[2].

Added to CISA KEV

On November 10, 2026, CISA added CVE-2026-111560 (OS command injection letting an authenticated administrator run commands as root) and CVE-2026-116606 (ESG authentication bypass letting an unauthenticated remote attacker invoke the configuration-import function and restore a crafted backup) to the Known Exploited Vulnerabilities catalog, with a federal remediation deadline of November 13, 2026 ^[4][5].

What to do

Barracuda advises customers whose devices did not auto-patch to install the manually (BNSF-40425 or BNSF-40430 for ESG), to re-enable automatic patching if it was turned off, and to restrict admin interface access to trusted internal networks ^[2].