The Exploit Bulletin — Friday, November 6, 2026: 2 issues require action
Friday, November 6, 2026 — 2 issues require action. If you run none of the software below, you are done.
Affects: BTCPay Server · Barracuda Email Security Gateway
1. Unauthenticated LND macaroon credential file disclosure in BTCPay Server enables theft of funds (CVE-2026-119757)
CREDENTIAL EXPOSURE · CRITICAL · CVSS 9.3
BTCPay Server's advisory confirms attackers have already used this flaw to steal funds, so an LND-backed deployment left on a pre-2.4.2 build can have its Lightning node credentials pulled and its funds drained by anyone who finds it.
BTCPay Server versions before 2.4.2, including the 2.4.2 release candidates, let an unauthenticated remote attacker retrieve .macaroon credential files for a connected LND Lightning node. With those credentials an attacker gains full control of the LND node and can move its funds; the vendor states the attacks it reviewed targeted only .macaroon files and that only LND-backed deployments are exposed.
Affected: BTCPay Server < 2.4.2 (all prior versions, including 2.4.2 release candidates) when used with LND
How to Test: Check the running BTCPay Server version: anything below 2.4.2, including any 2.4.2 release candidate, is vulnerable. Determine whether the instance is connected to an LND node — other Lightning implementations and non-Lightning deployments are not exposed to this credential risk. If LND is in use, treat its macaroon credentials as potentially exposed: review web server and reverse-proxy access logs for unauthenticated requests retrieving files with the .macaroon extension, and audit the LND node (including its own on-chain wallet) for unauthorized channel operations or fund movements.
How to Patch: Update BTCPay Server to version 2.4.2 immediately on any LND-backed deployment. Deployments using another Lightning implementation or no Lightning are not affected by the LND credential risk but should also update to 2.4.2.
Evidence: VulnCheck KEV
2. Pre-auth configuration-import bypass on Barracuda Email Security Gateway chains to root (CVE-2026-116606)
PUBLIC EXPLOIT · NO ATTACKS CONFIRMED · AUTHENTICATION BYPASS · CRITICAL · CVSS 9.3
watchTowr published a request-level proof of concept on 2026-11-05 for this unauthenticated bypass, which chains with CVE-2026-111560 to root command execution; no attacks are confirmed, but an unpatched ESG whose admin interface is reachable is open to anyone who reads the write-up.
Barracuda Email Security Gateway before 9.4.0.030 lets an unauthenticated attacker who can reach the administrative interface invoke the configuration-import function and restore a crafted backup archive, rewriting the appliance's global configuration. Combined with the command injection tracked as CVE-2026-111560, this gives root access to the device.
Affected: Barracuda Email Security Gateway (ESG) < 9.4.0.030
How to Test: Confirm the ESG firmware is 9.4.0.030 or later, or that patch BNSF-40425 (firmware 9.4.017 and up) or BNSF-40430 (below 9.4.017) has been applied. Determine whether the administrative UI is reachable from the internet. Review admin-interface access logs for configuration-import or backup-restore requests that did not come from an authenticated administrator session, and audit the global configuration for unexpected changes.
How to Patch: Update the ESG to 9.4.0.030, applying BNSF-40425 on firmware 9.4.017 and later or BNSF-40430 on earlier firmware, and apply Barracuda's patches for the companion command-injection CVE-2026-111560. Where the update must wait, remove public access to the administrative interface.
Evidence: watchTowr write-up with request-level proof of concept · watchTowr write-up (alternate URL)
Read on the web · Every past edition
The Exploit Bulletin is free and daily. It publishes only what security teams must act on today — nothing else. Forward it freely.
Spot an error, or an exploit we missed? Reply here or email [email protected].
