Barracuda published a security advisory on November 2, 2026 covering two vulnerabilities in six of its appliances, including the Email Security Gateway (ESG) that a lot of smaller companies put in front of their mailboxes. Barracuda says that when the two bugs are chained, an attacker could get past authorization checks and gain root access to the device. Patches are out, and the company is asking customers to confirm they’re on the latest firmware.

What’s new

  • CVE-2026-116606 (CVSS 9.3): an authorization bypass that affects only the Email Security Gateway.
  • CVE-2026-111560 (CVSS 8.6): a command injection bug in ESG, Load Balancer ADC, Message Archiver, WAF Control Center, Web Application Firewall and Web Security Gateway.
  • Barracuda has a separate patch for each product, listed in a table in the advisory. Both bugs depend on reaching the device’s admin interface.
  • The advisory doesn’t say whether either flaw has been used in attacks. BleepingComputer, which covered it on November 3, points out that older ESG flaws were exploited in real attacks in 2023.

Who it affects

Any business running one of those six Barracuda appliances. Barracuda’s advisory says some devices may not have received the patch automatically, particularly where someone switched automatic patching off. The advisory lists appliance products only and doesn’t mention Barracuda’s cloud email service.

Plenty of small firms bought a Barracuda box years ago through an IT provider and haven’t logged into it since. If that sounds familiar, ask your provider today which model you run and what firmware it’s on. Outdated devices are what attackers go after first, as Synology’s ransomware warning showed this week.

Our take

This is a this-week job. Nobody has reported attacks on these two bugs yet, so there’s time to do it properly. We’d log into each Barracuda appliance, compare its firmware with the patch table in the advisory, and apply the matching patch if it’s missing. Then we’d limit the admin interface to the office network or a VPN, which Barracuda also recommends, and switch automatic patching back on. If a device is several firmware versions behind, expect more than one update and book a short maintenance window for it.

Read Barracuda’s advisory for the full patch list. If you’d like someone to check your appliances and servers, our IT consulting team can help, and our website maintenance plans cover patching on the web side.