Affected Systems
Barracuda Email Security Gateway (ESG), Load Balancer ADC, Message Archiver (BMA), WAF Control Center (WCC), Web Application Firewall (WAF), and Web Security Gateway (WSG). CVE-2026-116606 affects ESG only; CVE-2026-111560 affects all listed products. Exploitation requires access to administrative interfaces.
Exploitation Status
No evidence of active exploitation reported. Patches released by vendor. Exploitation requires administrative interface access, reducing immediate threat surface.
Business Impact
Attackers with admin interface access can chain CVE-2026-116606 (ESG authentication bypass) and CVE-2026-111560 (OS command injection) to gain root-level control of devices. This enables full device compromise, configuration tampering, and potential lateral movement. Risk is elevated for organizations with inadequate network segmentation or exposed management interfaces. Barracuda's history of zero-day exploitation (CVE-2023-7102, CVE-2023-2868) increases urgency for patching.
Urgency
🟠Within 24 hours
Recommended Actions
- Immediately apply patches: BNSF-40425 (ESG 9.4.017+), BNSF-40430 (ESG <9.4.017), BNADC-16586 (ADC/WAF), BNMA-32468 (BMA), BNWF-60060 (WCC), BNYF-24789 (WSG)
- Verify administrative interfaces are not exposed to the internet; restrict access to trusted internal networks only using firewall rules or VPN
- Review access logs for Barracuda administrative interfaces for unauthorized login attempts or configuration changes since October 2026
- Confirm all Barracuda appliances are running latest firmware versions and have all security patches applied
- Implement network segmentation to isolate Barracuda appliances from general user networks and limit lateral movement risk