Barracuda ESG Vulnerability Chain Exploited in the Wild After PoC Exploit Release

TL;DR

Barracuda confirmed on November 9, 2026, that attackers are exploiting a Barracuda ESG vulnerability chain against “a small number of organizations.” The chain joins CVE-2026-116606, an authorization bypass, with CVE-2026-111560, a command injection bug. Together, they give an attacker root access to the Email Security Gateway. Notably, watchTowr Labs published full technical details and proof-of-concept exploit code six days earlier.

Two chained flaws let an unauthenticated attacker with access to the admin interface run commands as root on Barracuda ESG. Public exploit code has been available since November 3, and Barracuda now reports active attacks. Update to the latest firmware and lock down admin interfaces now.

Why It Matters

The ESG sits in front of company mail and inspects every message. As a result, a root compromise gives attackers a powerful foothold at the network edge. The appliance also has a painful history. In 2023, a China-linked group exploited CVE-2023-2868 as a zero-day, and some customers had to physically replace their devices.

Exploited in the wild

Barracuda’s updated advisory states: “We have identified exploitation activity affecting a small number of organizations.” It did not share how many customers were hit or who is behind the attacks. CISA has not yet added either CVE to its Known Exploited Vulnerabilities catalog, as of its November 9 update.

Public PoC exploit

The watchTowr Labs analysis of the Barracuda ESG pre-auth root RCE walks through both bugs in detail. In addition, the team released a Barracuda ESG proof-of-concept exploit on GitHub. It calls the script a “Detection Artifact Generator,” but it accepts any command an operator supplies. Because of this, the bar for attackers is now very low.

How the Attack Works

Step one: the authorization bypass

CVE-2026-116606 lives in the ESG password-change logic. When a password change fails, older code reported the error but did not stop the request. Instead, it kept processing other functions in the same request. According to the CVE record, this lets an unauthenticated attacker “restore a crafted, compatible backup archive.”

Step two: root command injection

CVE-2026-111560 sits in how the appliance handles the timezone setting. The code passed that value into a shell command without cleaning it. Since a helper script runs through sudo, injected commands execute as root. Meanwhile, a backup file can set the timezone value. watchTowr also found that backup checksums rely on a fixed, hard-coded secret, so attackers can forge valid files.

Put together, one crafted request uploads a malicious backup and runs commands as root.

Affected Versions

• CVE-2026-116606 (CVSS 9.3): Email Security Gateway only, versions earlier than 9.4.0.030
• CVE-2026-111560 (CVSS 8.6): ESG, Load Balancer ADC, Message Archiver, WAF Control Center, Web Application Firewall and Web Security Gateway

Only ESG is exposed to the full pre-auth chain. On the other products, the command injection still requires administrative access.

Patch and Mitigation

Barracuda urges customers to “ensure their systems are running the latest firmware version, and have all security patches applied.” Patches should apply automatically. However, admins who turned off auto-patching must install them by hand. Devices that are several versions behind may need more than one update.

Next, restrict the admin interface. Barracuda says organizations whose admin interfaces “are not publicly accessible from the internet are less exposed to this attack path.” Full guidance is in the Barracuda security advisory. The Canadian Centre for Cyber Security has also issued advisory AV26-1112 on the flaws.

Finally, any ESG with an internet-facing admin interface should be checked for signs of compromise. With working exploit code public, this Barracuda ESG vulnerability chain will likely draw more attacks.

×

Support Our Threat Intelligence

Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!

Buy Me a Coffee

PayPal

Select your plan

Free Pro Team

Hover over a plan to see its benefits.

Written by

@DdoS · Security Researcher

Do Son

Do Son is the Founder and Editor of SecurityOnline.info. Working in cybersecurity since 2013, he reports on vulnerabilities, malware, and emerging threats, providing timely analysis to help organizations and individuals stay ahead of evolving risks.