Barracuda disclosed two flaws on November 2. By November 10, they were being exploited.

CVE-2026-116606 (CVSS 9.3) — pre-auth bypass in ESG. An unauthenticated attacker invokes the configuration-import function and restores a crafted backup archive. No credentials required.

CVE-2026-111560 (CVSS 8.6) — command injection in the timezone setting, shared across ESG, Load Balancer ADC, Message Archiver, WAF Control Center, WAF, and Web Security Gateway.

The chain: bypass restores a backup with a malicious timezone value → injection fires → root shell.

What makes it practical: watchTowr Labs found a static, predictable checksum secret used to validate backup archives. Without it, forged backups fail validation. With it, the archive passes, the config applies, the command runs as root.

Patch IDs:

ESG: BNSF-40425 or BNSF-40430 → 9.4.0.030
ADC / WAF: BNADC-16586
Message Archiver: BNMA-32468
WAF Control Center: BNWF-60060
Web Security Gateway: BNYF-24789

CISA added both to KEV on November 10 — three-day federal deadline, shortest in the batch.

Patching closes the hole. It doesn’t answer whether someone came through it before November 2. Check configuration baselines, backup import logs, timezone values, and admin accounts before returning the appliance to production.

Full analysis + hunt checklist → threataft.com/articles/barracuda-esg-cve-2026-116606-111560-auth-bypass-root-chain