Tuskira AdvisoryNot observedLast updatedNovember 5, 2026

CVE-2026-116606

Barracuda Email Security Gateway Admin UI reachable without login; chained with CVE-2026-111560 it reaches root

CVE-2026-116606 lets anyone who can reach a Barracuda Email Security Gateway's admin interface use it without logging in. Barracuda updated its advisory on November 5 at 2:30 PM ET to say "Authentication is not required to exploit this vulnerability; however, exploitation requires the administrative user interface (Admin UI) to be accessible to the attacker." Combined with the companion bug CVE-2026-111560, Barracuda says an attacker can "bypass authorization controls and obtain root access to the device."

Barracuda and Mandiant score it 9.3 on CVSS 4.0. The fix is patch BNSF-40425 on firmware 9.4.017 and later, or BNSF-40430 on older builds, and Barracuda says the patch may already have been applied automatically. watchTowr Labs published a technical write-up and a detection tool on November 5. Nobody has reported exploitation, and it is not on CISA's KEV.

Vendor
Barracuda Networks
Product
Barracuda Email Security Gateway (ESG)
Affected versions
Email Security Gateway earlier than 9.4.0.030 (Mandiant MNDT-2026-0042). Companion CVE-2026-111560 also affects ADC, Message Archiver, WAF, WAF Control Center and Web Security Gateway (Barracuda advisory)
Vulnerable component
ESG administrative interface (Admin UI), configuration-import function
CVSS
9.3 (Barracuda and Mandiant as CNA, CVSS 4.0); companion CVE-2026-111560 is 8.6. NVD has not added its own score
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N (Mandiant)
CWE
CAPEC-115 Authentication Bypass (Mandiant)
Exploitation
Not observed
CISA KEV added
Patch
ESG patch BNSF-40425 on 9.4.017 and later, BNSF-40430 on builds older than 9.4.017 (Barracuda advisory). Barracuda says patches may already be applied automatically
Vendor fixResearcher advisory

Is it reachable for you?

What's affected. Barracuda Email Security Gateway. Mandiant's disclosure lists ESG "earlier than 9.4.0.030." Barracuda's advisory lists the ESG patches as BNSF-40425 for 9.4.017 and later and BNSF-40430 for older builds. CVE-2026-116606 affects only ESG.

The test. The no-login path is open on an ESG if the patch for its build is not applied and an attacker can reach its Admin UI.

  1. Check whether the patch is already on. Barracuda says "If a patch has not been automatically applied, customers should manually apply the appropriate patch as soon as possible." Look on each ESG for BNSF-40425 (9.4.017 and later) or BNSF-40430 (older builds), and confirm it shows as applied. If it is, this CVE is closed on that appliance.
  2. Check who can reach the Admin UI. Barracuda says organizations whose administrative interfaces "are not publicly accessible from the internet are less exposed to this attack path." Test from outside your network and from networks that shouldn't manage the gateway. If the Admin UI answers, treat the no-login path as open until the patch is confirmed.
  3. Check whether automatic patching is on. Barracuda says that if customers turned it off, they should set devices "to automatically receive patches."

How the chain works, per watchTowr Labs. watchTowr describes an unauthenticated request to /cgi-mod/index.cgi that continues into privileged handling and uploads a crafted backup, which restores the gateway's configuration, including the system timezone setting. CVE-2026-111560 is a command injection in that timezone field, so the restored value runs as root. You don't need to reproduce this to decide exposure. Admin UI reachability plus a missing patch is enough.

Companion: CVE-2026-111560. Barracuda scores it 8.6 and lists it as needing administrative access. It affects more products, each with its own patch.

  • Email Security Gateway (ESG): BNSF-40425 (9.4.017 and later), BNSF-40430 (older builds)
  • Load Balancer ADC: BNADC-16586
  • Message Archiver: BNMA-32468
  • WAF Control Center: BNWF-60060
  • Web Application Firewall: BNADC-16586
  • Web Security Gateway: BNYF-24789

On ADC, Message Archiver, WAF, WAF Control Center and Web Security Gateway, CVE-2026-111560 needs an admin login, so the no-login chain applies only to the Email Security Gateway. Apply the matching patch on those products anyway.

Compensating controls (test them, don't assume them)

These come from Barracuda's advisory. Each works only under the condition at the end of its line.

  • Delivery. Restrict the ESG Admin UI "to trusted internal networks and using appropriate network access controls." This only helps if you confirm the Admin UI can't be reached from the internet or untrusted segments, and it does not stop someone already inside a trusted network.
  • Exploitation. Turn automatic patching back on if it was off, apply BNSF-40425 or BNSF-40430 to match the build, and confirm the appliance shows the patch as applied. This only helps once the patch is confirmed on each appliance.

The patch is the only fix.

What to look for in logs

Barracuda and Mandiant have published no indicators. watchTowr Labs published a Detection Artefact Generator on November 5 that lets defenders check their own appliances. Run it only against gateways your organization owns.

How Tuskira helps

Tuskira is an agentic cyber defense platform that connects to the 200+ security and IT tools you already run. When a new critical vulnerability lands, Tuskira answers three questions.

Is there a reachable path? For example, whether a Barracuda Email Security Gateway without BNSF-40425 or BNSF-40430 has its Admin UI reachable from the internet or an untrusted network.

Would your controls stop it? Tuskira tests the controls you already run, such as your WAF, firewall rules and EDR, against the path.

Can you close the gap now? Quell stages the compensating control change through your existing tools, with your approval, then re-tests to confirm the path is closed.

The vendor patch is the complete fix. Quell reduces exposure and proves your controls work in the meantime.

See how Quell handles emerging threats

FAQ

Am I exposed to CVE-2026-116606?

Yes, if a Barracuda Email Security Gateway does not have BNSF-40425 (9.4.017 and later) or BNSF-40430 (older builds) applied and an attacker can reach its Admin UI.

Is CVE-2026-116606 being exploited?

Barracuda and Mandiant report no exploitation, and it is not on CISA KEV as of November 5, 2026. watchTowr Labs published technical details and a detection tool the same day.

Am I affected if I only run Barracuda ADC, WAF, Message Archiver, WAF Control Center or Web Security Gateway?

Not by CVE-2026-116606, which affects only the Email Security Gateway. Those products are affected by CVE-2026-111560, which needs an admin login. Apply each product's Barracuda patch.

Was this patched automatically?

Possibly. Barracuda says patches may already be applied automatically, and asks customers who turned automatic patching off to turn it back on. Check each appliance for the patch.

How do I mitigate CVE-2026-116606 without patching?

Keep the Admin UI off the internet and limit it to trusted internal networks, per Barracuda. That reduces who can use the no-login path but is not a fix.

Updates

Nov 5, 2026. First published, after Barracuda's 2:30 PM ET update changed CVE-2026-116606 to no authentication required. Public write-up and detection tool from watchTowr Labs; no exploitation reported; not on CISA KEV.

Sources

We publish an advisory when a vulnerability is Critical or on CISA KEV, has one identifiable component to check, and has a public proof of concept or reported exploitation. Advisories are updated as exploitation status changes.