Barracuda says attackers are exploiting two recently patched flaws in its Email Security Gateway (ESG) appliances. Chained together, the bugs can give an attacker root control of the device. CISA added both to its Known Exploited Vulnerabilities (KEV) catalog on November 10, which makes any ESG with a reachable admin interface an urgent patching job.
What happened
Barracuda published an advisory and patches on November 2. CVE-2026-116606 (CVSS 9.3) is an authorization bypass that affects only ESG. CVE-2026-111560 (CVSS 8.6) is a command injection bug that affects ESG and five other Barracuda products: the Load Balancer ADC, Message Archiver, WAF Control Center, Web Application Firewall and Web Security Gateway.
Mandiant, which published advisories for both flaws, describes the bypass as a way for an unauthenticated attacker to restore a crafted backup archive and change the appliance’s global configuration, according to SecurityWeek. The command injection sits in the timezone setting and lets someone with administrator rights run operating system commands as root. Combined, the pair gives root without credentials, as long as the attacker can reach the admin interface.
Barracuda’s advisory first said the bypass needed administrative access. On November 5 it corrected that: no authentication is required, but the admin interface must be reachable. On November 9 the company added that it had seen “exploitation activity affecting a small number of organizations.” CISA listed both CVEs on November 10, and SecurityWeek reports federal agencies were given three days to patch under BOD 26-04.
Security firm Previdian reports 18 exploitation attempts against CVE-2026-116606 from 16 IP addresses in four countries between November 9 and 11, as of its November 12 update. It stresses that attempts do not show a target was vulnerable or that an attack worked. Its tracking page also lists public proof-of-concept code, which it calls unverified, a scanner template, and a technical write-up from watchTowr dated November 5.
Who is affected and why it matters
The clearest target is any ESG that has not received the November patches and whose admin interface can be reached from the internet. The other five products are exposed only to the command injection, which Barracuda says requires administrator access.
An email gateway sits in the path of an organization’s mail. The Register notes that attackers with root could steal data, install backdoors and take full control of an affected system. ESG appliances have been hit before: SecurityWeek recalls that Chinese cyberspies exploited zero-day CVE-2023-2868 starting in October 2022, and Barracuda told customers to replace compromised devices. Nothing published so far links the current attacks to that campaign.
What to do
Barracuda’s guidance, from its advisory:
- Confirm each device runs the latest firmware and has every security patch. A device several versions behind may need more than one update, and Barracuda Support can help.
- Apply any patch that was not installed automatically, and turn automatic patching back on if it was disabled.
- Limit administrative interfaces to trusted internal networks.
| Product | Barracuda patch |
|---|---|
| Email Security Gateway | BNSF-40425 (9.4.017 and later); BNSF-40430 (earlier than 9.4.017) |
| Load Balancer ADC and Web Application Firewall | BNADC-16586 |
| Message Archiver | BNMA-32468 |
| WAF Control Center | BNWF-60060 |
| Web Security Gateway | BNYF-24789 |
Our analysis, not from the sources: patching closes the hole but does not show whether a device was already compromised. For any ESG whose admin interface was internet-reachable between November 2 and the day it was patched, check the configuration for unexpected changes, look for unfamiliar admin accounts and outbound connections, and consider outside incident-response help. If anything looks off, rotate the credentials the appliance holds or can reach.
What we still do not know
Barracuda has not said how many organizations were hit and declined to answer The Register’s questions on that point. It is unclear who is behind the attacks, whether intruders obtained root on any device, or whether data was stolen. The advisory we reviewed lists no indicators of compromise, and SecurityWeek reports that neither Barracuda nor CISA has shared details of the exploitation.
Sources: Barracuda security advisory (updated Nov. 9, 2026); SecurityWeek, Nov. 11, 2026; SecurityWeek, Nov. 4, 2026; The Register, Nov. 10, 2026; CISA alert, Nov. 10, 2026; Previdian, updated Nov. 12, 2026.
Leave a Reply