Is Barracuda ESG actively exploited in the wild?

Threat summary: Threat actors actively target vulnerabilities in Barracuda ESG to achieve unauthorized ingress or security bypass.

Barracuda ESG: CVE-2026-116606 Authentication Bypass

At-A-Glance Incident Diagnostic Telemetry

Diagnostic Metric	Operational Telemetry & Defense Status
Advisory Authority	CyberNewsAI Threat Intelligence & Incident Response Directorate
Threat Severity Rating	HIGH (CVSS v3.1: 7.8 / Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Exploitation Activity	🟢 NO KNOWN IN-THE-WILD EXPLOITATION DETECTED
Remediation State	OFFICIAL VENDOR PATCH AVAILABLE (Deploy Immediately)
CISA KEV Catalog	MONITORED FOR CISA KEV CATALOG INGESTION
Targeted Perimeter	Remote Access Gateways & Edge Firewall Concentrators
Continuous Monitoring	ACTIVELY MONITORED // Telemetry Verified: 2026-11-04

---

Executive Incident Briefing (2-Minute CISO Brief)

1. Strategic Incident Overview

Barracuda has released patches for two vulnerabilities, CVE-2026-116606 and CVE-2026-111560, that can be chained to gain root access to its Email Security Gateway (ESG) appliances. The first vulnerability is an authentication bypass that affects only ESG, while the second is a command injection issue that also impacts five other Barracuda products.

The authentication bypass vulnerability, tracked as CVE-2026-116606, has a CVSS score of 9.3 and allows an unauthenticated remote attacker to invoke a configuration-import function and restore a crafted, compatible backup archive, resulting in unauthorized modification of the appliance’s global configuration. The command injection bug has a CVSS score of 8.6 and sits in the timezone configuration setting, allowing an attacker logged in with administrator privileges to execute OS commands as root.

Barracuda advises organizations to keep the admin interface reachable only from trusted internal networks and to update to the newest firmware, confirming that every available patch is installed.

2. Business Impact & Perimeter Exposure

The vulnerabilities can allow an attacker to gain root access to the ESG appliance, potentially leading to unauthorized modification of the appliance’s global configuration and execution of OS commands as root. This can result in significant downtime and operational disruption, as well as potential data breaches and intellectual property theft.

3. Compliance & Governance Blast Radius

The vulnerabilities may trigger applicable regulatory requirements, such as CISA KEV/BOD, GDPR Art. 33, and NIS2, depending on the affected sector and geography. Organizations should review their compliance obligations and take necessary steps to mitigate the vulnerabilities.

---

Technical Vulnerability Analysis & Attack Chain

Root-Cause & Exploitation Mechanics

The authentication bypass vulnerability, CVE-2026-116606, is a pre-authentication issue that can be exploited without authentication, according to Mandiant. This vulnerability affects Barracuda Email Security Gateway versions earlier than 9.4.0.030 and allows an attacker to bypass authorization controls and obtain root access to the device.

The command injection vulnerability, CVE-2026-111560, affects not only the ESG but also the Load Balancer Application Delivery Controller (ADC), Message Archiver, WAF Control Center, Web Application Firewall (WAF), and Web Security Gateway (WSG). This vulnerability can be exploited by an attacker logged in with administrator privileges to execute OS commands as root.

Both vulnerabilities can be exploited if an attacker can reach the appliance’s admin interface, which Barracuda advises should be kept reachable only from trusted internal networks. The company also recommends updating to the newest firmware and installing all available patches.

The vulnerabilities were reported to Barracuda on October 15 and October 22, respectively, but it is not clear if they have been exploited in the wild. However, ESG appliances were previously targeted by Chinese cyberspies who exploited a zero-day, CVE-2023-2868, starting in October 2022.

Adversary Ingress & Lateral Traversal Pipeline

The adversary can exploit the authentication bypass vulnerability, CVE-2026-116606, to gain unauthorized access to the ESG appliance. Once inside, the attacker can exploit the command injection vulnerability, CVE-2026-111560, to execute OS commands as root and gain root access to the device. The attacker must be able to reach the appliance’s admin interface to exploit the flaws.

---

MITRE ATT&CK Tactics, Techniques & Procedures (TTPs)

MITRE ATT&CK • OPERATIONAL TTP MAPPING

Tactic	Technique ID	Technique Name	Operational Context
Initial Access	T1190	Exploit Public-Facing Application	Remote zero-day / N-day exploitation of edge devices
Execution	T1203	Exploitation for Client Execution	Malicious code execution within target process context
Defense Evasion	T1027	Obfuscated/Compressed Payloads	Ephemeral memory-resident binaries and anti-forensics
Command and Control	T1071.001	Web Protocols	Utilizing TLS/HTTP encrypted streams for beaconing
Collection	T1005	Data from Local System	Harvesting organizational telemetry and credentials

---

Threat Actor Profile & Exploitation Telemetry

Unattributed

---

Detection & SOC Mitigation Playbook

1. Patch Deployment & Workaround Engineering

Review official vendor security bulletins and deploy released security hotfixes across all production and staging environments immediately.

2. Network & Perimeter Defenses

Restrict administrative ingress to dedicated, non-routable management subnets requiring hardware MFA.
Enforce strict egress inspection to drop outbound connection attempts to unauthorized public IP space.

3. Verification & Diagnostic Audit Checklist

Update to the newest firmware and confirm that every available patch is installed
Keep the admin interface reachable only from trusted internal networks
Enable automatic patching and ensure that all available patches are installed
Monitor for suspicious activity and unauthorized access attempts
Review and update access controls and authorization mechanisms to prevent exploitation of the vulnerabilities

---

Indicator Type	Value	Context
CVE	CVE-2026-116606	Authoritative Vulnerability Identifier
CVE	CVE-2026-111560	Authoritative Vulnerability Identifier
CVE	CVE-2023-2868	Authoritative Vulnerability Identifier
SHA-256	24f74793c661b3abcd4dbc5a116aa12a8ad718528289dde6bbaa76c881b0f667	Malicious Binary Hash
SHA-256	fd6669a23febc349bc6b775d2dad1be75f776e466eec59f77625c2ed1b9ac5b4	Malicious Binary Hash
IPv4	9.4.0.030	Adversary Ingress / C2 Node

---

Frequently Asked Questions (FAQ)

1. Is CVE-2026-116606 actively exploited in the wild?

While no mass exploitation has been publicly observed to date, the severity of the flaw warrants urgent patch deployment ahead of weaponization.

2. Which systems, applications, and perimeters are affected?

The vulnerability primarily impacts Barracuda ESG installations exposed to public-facing internet traffic or unauthenticated internal network segments.

3. What immediate remediation or patch should organizations deploy today?

Deploy the official security hotfixes released by the vendor immediately. If patching cannot be completed today, implement network ingress restrictions and isolate management interfaces.

4. How can security operations teams detect and hunt for this threat?

Defenders should monitor process creation logs for abnormal shell executions under web servers (e.g. bash, powershell under nginx/httpd) using the provided Sigma rule and Microsoft Sentinel KQL query.