Barracuda Email Security Gateway Flaws Exploited: What to Do

What to do today

This advisory is current as of 11 November 2026. The priorities are the same whether you run one appliance or several, and they are in this order because exposure matters as much as the patch.

1. Find every Barracuda appliance that could be affected. The authorisation bypass (CVE-2026-116606) affects the Email Security Gateway only. The command injection (CVE-2026-111560) also affects other Barracuda products, listed in the next section.
2. Check the firmware version on each appliance. Barracuda says patches are normally applied automatically, so you are probably current, but confirm it rather than assume it.
3. If the patch has not arrived, apply it manually using Barracuda's update instructions or ask Barracuda Support for help. If automatic updates have been switched off, Barracuda recommends turning them back on. An appliance that is several versions behind may need more than one update.
4. Check who can reach the appliance's administration interface. Barracuda's advisory says exploitation needs access to that interface, and recommends keeping it off the public internet and limited to trusted internal networks. Restrict it with your firewall or network access controls if it is open more widely than that.
5. If the interface was reachable from the internet before you patched, read the section on checking for earlier compromise before you consider the job finished.

What is confirmed, and what is not

Barracuda published its advisory on 2 November 2026. On 9 November 2026 (9:00pm EST) it added a statement that it had observed exploitation activity affecting a small number of organisations. On 10 November 2026 CISA added both CVE-2026-116606 and CVE-2026-111560 to its Known Exploited Vulnerabilities (KEV) catalogue, which is credible evidence of exploitation in the wild.

Some limits are worth stating plainly. Barracuda has not published indicators of compromise such as IP addresses, file hashes or log signatures. Neither Barracuda nor CISA has named any victim, and a KEV entry does not identify who was affected. The CISA catalogue shows ransomware use as unknown. We are not aware of any public, credibly sourced account that ties a named organisation to these two CVEs, so we name none.

Barracuda's own wording on authentication is also slightly awkward. It describes CVE-2026-116606 as a pre-authentication bypass, then clarifies on 5 November that no login is needed to exploit it but the attacker must be able to reach the administrative interface. Treat that as the practical boundary: anyone who can reach the admin interface of an unpatched appliance is in the frame.

Which products and versions are affected

Barracuda lists these products and patch identifiers. The advisory does not give a full list of affected firmware builds beyond the Email Security Gateway patch thresholds, so the safe reading is that any product on the list that has not received its patch is affected.

• Email Security Gateway (ESG): affected by both CVE-2026-116606 and CVE-2026-111560. Barracuda lists patch BNSF-40425 for firmware 9.4.017 and later, and BNSF-40430 for earlier firmware.
• Load Balancer ADC: CVE-2026-111560 only. Patch BNADC-16586.
• Web Application Firewall (WAF): CVE-2026-111560 only. Patch BNADC-16586.
• Message Archiver (BMA): CVE-2026-111560 only. Patch BNMA-32468.
• WAF Control Center (WCC): CVE-2026-111560 only. Patch BNWF-60060.
• Web Security Gateway (WSG): CVE-2026-111560 only. Patch BNYF-24789.

Which firmware build counts as fixed

Aim for ESG firmware 9.4.0.030 or later. Public sources disagree slightly on the exact boundary. One independent technical write-up from watchTowr names 9.4.0.029 as the fixed build, while SecurityWeek reports the CVE record for the authorisation bypass as covering ESG versions earlier than 9.4.0.030. Until Barracuda Support confirms otherwise, 9.4.0.029 is not a safe place to stop.

Barracuda's patch process shows the latest available firmware on the appliance itself, so installing whatever it offers and then re-checking the displayed version is the simplest route. For the other products in the list, apply the patch Barracuda names and confirm the appliance reports it as installed.

How the two flaws fit together

An authorisation bypass is a flaw that lets someone do something they should need permission for. Here, CVE-2026-116606 (CVSS 9.3, as scored by Barracuda) lets an attacker who can reach the ESG admin interface get past its authorisation checks. CISA's catalogue summarises it as allowing an unauthenticated attacker to import a crafted backup and change the appliance's global configuration.

Command injection means an attacker can get the device to run instructions they supplied. CVE-2026-111560 (CVSS 8.6) normally requires an administrator account, and CISA describes it as running commands as root through a crafted timezone value. Barracuda says that when the two are combined an attacker could bypass authorisation controls and obtain root access to the device. Root is the highest level of control on the system.

That matters because a mail gateway sits in the path of all your inbound and often outbound mail, and holds configuration and credentials for the systems it talks to. A single-appliance problem can become a mail-flow and credential problem quickly. CVSS describes technical severity, not how likely an attack is against you; the confirmed exploitation is what lifts the urgency here.

Patching and confirming it worked

Barracuda says patches are normally pushed automatically and that customers should apply them manually as soon as possible if one has not been applied. Its manual instructions are on Barracuda Campus, linked in the sources below, and Barracuda Support can help if the appliance is well behind. Expect a firmware update to interrupt mail processing on a single appliance, so schedule it with that in mind, and check how your mail is routed if you have only one gateway.

1. Open the appliance's administration interface from a trusted internal network and note the current firmware version.
2. Install the latest available firmware, repeating the update if the appliance reports that further versions are available.
3. Once it has restarted, open the interface again and confirm the displayed version is at least 9.4.0.030 for an ESG. Confirm that automatic updates are enabled.
4. Send and receive a test message through the gateway to confirm mail flow is normal.

Checking whether an appliance was already compromised

A patch closes the hole. It does not remove anyone who already got in. Because Barracuda has published no indicators of compromise, there is no vendor checklist to run, and the sensible approach is to judge exposure first.

The key question is whether the admin interface was reachable from the internet at any point since the advisory became public on 2 November 2026 (and earlier, if the appliance was unpatched for longer). If it was never reachable from outside your trusted networks, the risk from these particular flaws is much lower, though Barracuda's confirmed exploitation means it should not be dismissed outright.

• Review firewall or reverse-proxy logs for connections to the appliance's admin interface from addresses outside your own networks.
• Look for configuration changes, new or unexpected administrator accounts and unexpected restore or backup activity that nobody on your team made.
• If the interface was exposed and you see anything you cannot explain, contact Barracuda Support and bring in an incident responder. As our own judgement rather than vendor guidance, plan to change credentials the appliance holds, such as directory lookup accounts, relay credentials and administrator passwords, once you are confident the device is clean.
• The UK NCSC's guidance on responding to active exploitation is a good framework if you need to treat this as an incident.