Barracuda Confirms Attacks on Two Email Security Gateway Flaws

Barracuda says attackers are now exploiting two vulnerabilities in its Email Security Gateway (ESG) that, chained together, can give an attacker root access to the appliance. In an update to its security advisory posted on the evening of 9 November 2026, the company wrote that it has "identified exploitation activity affecting a small number of organizations".

Barracuda disclosed and patched the two flaws, CVE-2026-116606 and CVE-2026-111560, on 2 November. One day after the exploitation update, the US Cybersecurity and Infrastructure Security Agency (CISA) added both to its Known Exploited Vulnerabilities catalog. An ESG sits in the path of an organisation's email, so a compromised gateway is a mail security problem, not just a server problem.

What Barracuda disclosed

The first flaw, CVE-2026-116606, is a pre-authentication authorization bypass in the ESG, rated 9.3. On 5 November Barracuda corrected its own advisory: it had first listed the bug as requiring administrative authentication, then changed the field to "No (Administrative UI Access Required)". In other words, the attacker does not need a password, but does need to reach the admin interface.

The second flaw, CVE-2026-111560, is a command injection rated 8.6 that needs administrative access. It affects the ESG and five other Barracuda products. According to Barracuda, "if exploited in combination, these vulnerabilities could allow an attacker to bypass authorization controls and obtain root access to the device." The first bug supplies the access that the second one requires.

Barracuda has not said how many customers were hit, which product versions they ran or what the attackers did on the devices. The advisory says only that exploitation was observed and that patches are available.

Exposure depends on the admin interface

The advisory makes one point clearly: organisations whose administrative interfaces are not reachable from the internet are "less exposed to this attack path". Barracuda recommends limiting admin access to trusted internal networks and using network access controls to enforce that. A gateway whose admin console is open to the internet is the case to fix first.

CISA deadline and forensic triage

CISA added both CVEs to the KEV catalog on 10 November 2026 with a due date of 13 November 2026 for US federal civilian agencies. Both entries are also flagged for forensic triage under CISA's BOD 26-04 guidance, which means agencies are expected to check for signs of compromise, not just apply the patch. The deadline is binding only on those agencies, but a three-day window is a clear signal of how urgent CISA considers the issue.

Action checklist

• Close the admin interface to the internet and allow it only from trusted internal networks, as Barracuda recommends.
• Check the firmware version on every ESG and confirm that BNSF-40425 (9.4.017 and later) or BNSF-40430 (before 9.4.017) is applied.
• Turn automatic patching back on if it was disabled; Barracuda says patches that were not applied automatically must be applied manually.
• Plan several updates for devices that are multiple firmware versions behind, and contact Barracuda Support if the device cannot reach the current version.
• Patch the other products that share the command injection flaw: ADC and WAF (BNADC-16586), Message Archiver (BMA, BNMA-32468), WAF Control Center (BNWF-60060) and Web Security Gateway (BNYF-24789).
• Review admin activity and configuration changes on exposed devices since late October, and involve your security team if anything does not match your own changes.
• Watch your mail flow for unexpected routing, relay or filtering changes on domains that pass through the gateway.

Sources

1. Barracuda: Pre-Authentication Authorization Bypass and Command Injection Vulnerabilities in Certain Barracuda Products, updated 9 November 2026 (primary source)
2. CISA: Known Exploited Vulnerabilities Catalog, entries added 10 November 2026
3. NIST NVD: CVE-2026-116606
4. NIST NVD: CVE-2026-111560

Related on SMTPedia

• Barracuda Reputation BL: email blocklist removal guide
• Blocked by Barracuda Central (b.barracudacentral.org): delisting guide
• How to detect phishing emails that pass every check