Barracuda ESG CVE-2026-116606: Root-Access Chain Now Under Active Exploitation

Barracuda Networks disclosed that two chained vulnerabilities in its Email Security Gateway, an authentication bypass tracked as CVE-2026-116606 and an OS command injection tracked as CVE-2026-111560, let an unauthenticated attacker reach a root shell on the appliance. Barracuda's advisory confirms active exploitation and names an attacker window of 15 October through 2 November 2026, before any patch existed.

Key takeaways

• CVE-2026-116606 is a pre-authentication bypass built on a predictable secret in Barracuda ESG's admin interface, and CVE-2026-111560 is an OS command injection that turns that access into root, per Beazley Security's advisory and watchtowr Labs' technical breakdown.
• Barracuda's own advisory discloses that exploitation began before patches shipped, which means patching closes the door going forward but says nothing about whether the door was already used.
• A public proof-of-concept accelerated broader, opportunistic attacks against unpatched gateways, according to SecurityOnline's reporting.
• Detecting prior compromise requires appliance log review, not vendor-issued indicators of compromise, because none have been published for this specific exploitation window.

What are CVE-2026-116606 and CVE-2026-111560?

CVE-2026-116606 is an authentication bypass in Barracuda Email Security Gateway's administrative interface, caused by a predictable secret value that lets an attacker forge a valid session without credentials. The DEV Community technical writeup walks through how that predictability is derived and reused.

CVE-2026-111560 is an OS command injection vulnerability affecting Barracuda appliances, allowing an authenticated session (including a forged one) to run arbitrary operating-system commands. Brandefense's vulnerability brief and hol.org's CVE detail page both describe the injection point inside the admin workflow.

Chained together, the two bugs give an unauthenticated remote attacker a root shell on the appliance with no credentials and no user interaction. Ostorlab's analysis frames this as a textbook example of how a low-severity predictability bug becomes critical the moment it's paired with command execution.

Who is affected and what's the exploitation timeline?

Barracuda Email Security Gateway is the primary affected product, but Rescana's advisory notes the underlying command injection also touches Barracuda's WAF, ADC and Message Archiver lines, so a patch inventory needs to cover more than just the mail gateway.

The timeline matters as much as the CVSS score. Barracuda's advisory states that exploitation was already occurring between 15 October and 2 November 2026, discovered through Barracuda's work with Mandiant, before a patch was available. Patches followed, and a public exploit chain then circulated, which SecurityOnline and TechBytes both report has driven a second, broader wave of opportunistic attacks against appliances that hadn't yet applied the fix.

So there are effectively two exploitation populations: a narrow, earlier window with no public tooling, and a wide, later window with a working PoC in circulation. Any affected organization needs to account for both.

Why patching the firmware isn't the finish line

Applying Barracuda's patch answers one question: can this exploit chain be used against the appliance going forward. It does not answer the question that actually determines your incident response, which is whether the appliance was already compromised during the 15 October to 2 November 2026 window Barracuda disclosed.

That's the gap vendor advisories routinely leave open, and it's the same pattern this site has flagged with GitLab's one-day exploit and Cisco's Secure Email Gateway root RCE: a patch confirms the hole is closed, not that nobody walked through it first. No vendor-issued indicators of compromise exist for this specific chain yet, per hol.org's campaign tracking, which means retrospective hunting has to rely on the appliance's own logs, not a feed someone else publishes for you.

What to check on the appliance right now

Confirming the gateway wasn't already hit means reviewing ESG logs across the disclosed window for a specific set of signals, not waiting for a signature.

The socfortress technical assessment and nflo.tech's knowledge base entries both walk through log fields worth pulling for this review, which is a reasonable starting checklist if you're doing this manually.

What partners should do now

For MSSPs managing Barracuda ESG on behalf of clients, the sequence matters: patch immediately, then hunt backward through the disclosed window, then decide on containment based on what the logs show, not on a wait-and-see posture.

• Patch every affected appliance, including WAF, ADC and Message Archiver instances per Rescana's scope note.
• Pull admin-session and configuration-change logs for 15 October through 2 November 2026 specifically, since that's the window Barracuda confirmed.
• Treat any unexpected config import or timezone change as a containment trigger, not a ticket to review next shift.
• Don't wait on vendor IOCs for this chain. None exist yet for the pre-patch exploitation window, so log-based hunting is the only option.

This is exactly the scenario log-based threat hunting and 24/7 SOC monitoring exist for: catching the admin session from an IP that doesn't belong, and isolating the device the moment a config import looks wrong, rather than after someone reads a new advisory three weeks from now. If a client's gateway shows signs of prior compromise, that moves into incident response territory, not a patch-and-move-on ticket.

For MSPs and MSSPs running Barracuda appliances across multiple client environments, white-label SOC coverage extends this same log review and containment discipline across the whole book without adding headcount, and we never compete with our partners for their clients.

If your team is still deciding whether log review for this chain is a one-off project or something your monitoring should catch automatically going forward, that's a conversation worth having with Vijilan's MSP partner program before the next appliance CVE lands.