CVE-2026-116606 is an authentication bypass in Barracuda Email Security Gateway (ESG), an appliance or virtual appliance placed in front of an organisation’s mail system to filter spam, phishing, malware and outbound data. It is principally an installed-base problem: organisations operating their own mail-security edge and managed service providers running ESG for customers may have it, including deployments in a DMZ or cloud tenant.
The attacker does not need administrative credentials, but they do need network reachability to ESG’s administrative UI. That distinction matters. Exposing mail delivery services is not necessarily the same as exposing the management plane, yet a reachable admin interface turns a perimeter email appliance into the target.
A failed login path that kept processing
The bypass lets an unauthenticated caller reach the configuration-import function and restore a crafted, compatible backup archive. That grants unauthorised modification of the appliance’s global configuration—not automatically operating-system command execution on its own, but a powerful control point over a device that inspects and routes organisational email.
watchTowr’s analysis of Barracuda’s distributed patch files found that a failed password-change path returned the session’s low-privilege role instead of stopping the request. The key vulnerable fragment was:
};
$self->audit("failed_password_change", $params->{user});
return $userrole;In other words, the response handler could continue into module handlers after the authentication-related failure. Barracuda has not released its proprietary source or a complete source-control diff; the available comparison comes from watchTowr’s patch analysis.
Configuration control becomes root in a chain
The impact becomes more severe when paired with CVE-2026-111560, a separate command-injection issue. Researchers demonstrated that the bypass can feed the backup-restoration path and then use that second flaw to obtain root command execution. Public Python code exists for that chain: despite being called a “Detection Artifact Generator,” its documented flow accepts an arbitrary command, builds and uploads a backup, then triggers the vulnerable path. That makes it public exploit/PoC material, not merely a scanner.
There is no confirmed in-the-wild exploitation, attributed campaign, or victim incident for CVE-2026-116606 as of November 7, 2026. It was also absent from CISA’s KEV catalogue data version 2026.11.06. The supplied November 3 exploit-publication timestamp could not be independently verified from GitHub metadata, though watchTowr publicly documented and linked the code on November 5.
Patch the appliance and close the management path
The CNA advisory places ESG versions earlier than 9.4.0.030 in the affected range. Barracuda supplies hotfix BNSF-40425 for firmware “9.4.017+” and BNSF-40430 for lower versions, and tells customers to install the applicable patch and current firmware. Its version notation is not fully aligned with the CNA wording: reporting that 9.4.0.029 was fixed conflicts with the CNA’s affected boundary, and the sources do not resolve whether a separately patched 9.4.0.029 system is safe.
Treat the CNA boundary as the established baseline, apply Barracuda’s applicable hotfix, and upgrade to the latest available firmware. Restrict the administrative UI to trusted management networks, verify it cannot be reached from untrusted networks, and review configuration changes and backups for unexpected imports. SecAlerts monitors an organisation’s actual software stack and alerts on new vulnerabilities affecting the products it runs—useful here because a retired-for-sale appliance can remain very much in service.
