CVE-2026-116606 + CVE-2026-111560: How a Predictable Secret Turns Two Barracuda Bugs Into a Root Shell

Barracuda disclosed two flaws on November 2. By November 10, they were being exploited. CVE-2026-116606 (CVSS 9.3) — pre-auth bypass in ESG. An unauthenticated attacker invokes the configuration-import function and restores a crafted backup archive. No credentials required. CVE-2026-111560 (CVSS 8.6) — command injection in the timezone setting, shared across ESG, Load Balancer ADC, Message Archiver, WAF Control Center, WAF, and Web Security Gateway. The chain: bypass restores a backup with a malicious timezone value → injection fires → root shell. What makes it practical: watchTowr Labs found a static, predictable checksum secret used to validate backup archives. Without it, forged backups fail validation. With it, the archive passes, the config applies, the command runs as root. Patch IDs: ESG: BNSF-40425 or BNSF-40430 → 9.4.0.030 ADC / WAF: BNADC-16586 Message Archiver: BNMA-32468 WAF Control Center: BNWF-60060 Web Security Gateway: BNYF-24789 CISA added both to KEV on November 10 — three-day federal deadline, shortest in the batch. Patching closes the hole. It doesn’t answer whether someone came through it before November 2. Check configuration baselines, backup import logs, timezone values, and admin accounts before returning the appliance to production. Full analysis + hunt checklist → threataft.com/articles/barracuda-esg-cve-2026-116606-111560-auth-bypass-root-chain