What happened
Barracuda published the two advisories on 2 November 2026 and updated its notice at 21:00 EST on 9 November 2026 to say it had identified exploitation affecting a small number of organisations. CISA added both CVEs to KEV on 10 November 2026 and set a 13 November 2026 federal remediation deadline with forensic triage required.
CVE-2026-116606 affects Barracuda Email Security Gateway versions earlier than 9.4.0.030 and allows an unauthenticated remote attacker with Admin UI reachability to restore a crafted compatible backup archive and modify global configuration. CVE-2026-111560 affects ESG through 9.4.0.27, Load Balancer ADC through 6.4.0, WAF through 11.0.1, Web Security Gateway through 16.1.100.100, Message Archiver through 5.5.4.0 and WAF Control Center through 2.2.1. Barracuda lists ESG patches BNSF-40425 and BNSF-40430, BNADC-16586 for ADC and WAF, BNMA-32468 for Message Archiver, BNWF-60060 for WAF Control Center and BNYF-24789 for Web Security Gateway.
Previdian observed 17 attempts from 15 IP addresses in three countries between 9 and 11 November 2026. Those observations show exploitation attempts rather than confirmed success on the targeted devices. Barracuda and CISA had not published exploit artefacts, victim names or compromise indicators by the publication cutoff. Attribution posture: Barracuda and CISA named no actor behind the confirmed exploitation.
Why this matters now
The chain crosses a critical threshold: an unauthenticated attacker with reachability to the ESG administrative interface can alter configuration and then use the command-injection flaw to execute as root. Because the affected products are security and traffic-management appliances, compromise can undermine the controls relied on to inspect, route or archive enterprise communications.
CISA’s forensic-triage requirement means a successful patch cannot serve as the sole closure artefact. Any device that was vulnerable and administratively reachable must be assessed as a possible compromise, with evidence preserved before automated patching, rebooting or replacement removes the most useful records.
Fresh attempts observed across multiple IP addresses and countries show that the activity is not limited to the small number of organisations acknowledged by Barracuda. Those observations do not prove successful compromise, but they strengthen the case for immediate exposure validation across every affected appliance family.
The decision for security leaders
The email or network security owner should establish an appliance-level inventory covering product, version, patch ID and administrative-interface reachability. Prioritise devices exposed to untrusted networks, but do not treat internal-only reachability as proof that exploitation was impossible.
Incident response should preserve relevant appliance evidence before remediation where feasible, then assess configuration imports, administrator activity, timezone changes, root-level execution and persistence. If evidence quality is inadequate or compromise is suspected, rebuild the appliance from trusted media and validated configuration.
Business owners should prepare continuity options before isolating an ESG, WAF or traffic-management appliance. The CISO should require two closure statements: remediation is complete, and compromise has either been excluded with evidence or managed through the incident process.
Evidence of closure
- Asset inventory records product, version, patch ID and administrative-interface reachability.
- Appliance status confirms current firmware and applicable patch installed.
- Firewall validation proves administrative interfaces are not internet-accessible.
- Forensic report disposes configuration imports, timezone changes and root-level anomalies.
The Security.io assessment
Security.io assesses this as a confirmed active-exploitation issue with privileged impact. Barracuda’s acknowledgement and CISA’s KEV action justify emergency treatment, while the absence of public victim details and indicators limits external assessment of campaign scale and post-exploitation behaviour.
The administrative-interface condition is the decisive exposure variable. Internet restriction materially reduces the attack path but does not replace patching, and a current patch does not answer whether an attacker obtained root before remediation. Asset reachability and compromise status must therefore be reported separately.
The operational gap is forensic guidance. Neither Barracuda nor CISA published campaign-specific artefacts by the cutoff, so organisations must rely on appliance logs, configuration history, network telemetry and rebuild assurance. Devices with poor logging or uncertain exposure should receive the more conservative incident disposition.
Questions for the morning meeting
- Which security appliances can be administered from the internet?
- Do we preserve appliance evidence before automated updates?
- Can the appliance be rebuilt from trusted configuration?
- Who owns mail continuity if ESG isolation is required?