Barracuda Says Attackers Are Now Exploiting Its Email Gateway Flaws

Barracuda says attackers are now exploiting the two flaws it patched in its Email Security Gateway (ESG) earlier this month. The company updated its security advisory on November 9, 2026, at 9:00 pm EST to say it has seen exploitation activity affecting a small number of organizations. When we covered the patches in our first brief on these flaws, Barracuda had reported no attacks. That has changed, so any unpatched appliance should be treated as urgent.

What’s new

• The two bugs are CVE-2026-116606, an authorization bypass in ESG, and CVE-2026-111560, a command injection flaw. Barracuda says chaining them can give an attacker root access to the device.
• A November 5 update to the advisory changed CVE-2026-116606 to need no login at all. The catch for attackers is that the appliance’s admin interface has to be reachable from where they are.
• The ESG fixes are patch BNSF-40425 for firmware 9.4.017 and later, and BNSF-40430 for older versions. The command injection flaw also affects the Load Balancer ADC, Message Archiver, WAF Control Center, Web Application Firewall and Web Security Gateway, each with its own patch in the advisory.

BleepingComputer reported the exploitation on November 10. Barracuda hasn’t said who is behind the attacks or how many devices were hit beyond “a small number of organizations.”

Who it affects

Businesses that run a Barracuda ESG or one of the five other appliances listed in the advisory. Many small firms got their email filtering through an IT provider years ago and rarely look at it, so it’s worth asking. If auto-patching was switched off, the fix may not be installed.

Our take

Ask whoever manages your email security to confirm today that the right patch from the advisory is installed, and that the admin interface can only be reached from your internal network. If the patch went on late or the admin page was open to the internet, we’d also review recent admin logins and configuration changes, and contact Barracuda support to check the device. Turn automatic patching back on once you’re done.

Primary source: Barracuda security advisory.

Need help checking your email and website security setup? Our IT consulting team can review it, and our website maintenance plans cover patching for the sites we look after.