Barracuda email gateway flaws now exploited
Two Barracuda Email Security Gateway flaws patched on November 2 are now used in attacks. Which products are affected, the patches and what to check.
If your business filters its email through a Barracuda Email Security Gateway appliance, two flaws patched at the start of November are now being used in attacks. Barracuda published its advisory on November 2, 2026, and updated it on the evening of November 9 to say it had identified exploitation affecting "a small number of organizations." On November 10, CISA added both flaws to its catalog of known exploited vulnerabilities.
The two flaws
According to Barracuda's security advisory:
- CVE-2026-116606 (CVSS 9.3) affects the Email Security Gateway only. It lets someone who can reach the appliance's admin web interface get past its authorization checks without logging in, restore a crafted backup file and change the configuration. Barracuda first listed it as needing an admin login, then corrected that on November 5.
- CVE-2026-111560 (CVSS 8.6) is a command injection flaw that needs administrative access, and runs commands as root. It also affects Barracuda's Load Balancer ADC, Message Archiver, WAF, WAF Control Center and Web Security Gateway.
Together, Barracuda says, they could let an attacker bypass authorization and obtain root access to an Email Security Gateway. SecurityWeek reports that Barracuda and CISA have not shared details of the attacks, and that federal agencies were given three days to patch.
Why this matters for a small business
An email gateway sits in front of every message your company sends and receives. An attacker with root access to it is in a position to read or tamper with mail and to use the box as a foothold. That is why a flaw like this is worth acting on even if you have never logged in to the appliance yourself, which is common when a vendor or former IT provider set it up years ago.
The advisory does not list Barracuda's cloud-hosted Email Protection service among the affected products, only the appliances named above. If you are not sure which one you have, check your contracts or ask whoever manages your email.
What to do
- Confirm the patches are installed. For the Email Security Gateway, Barracuda's patch is BNSF-40425 for version 9.4.017 and later, or BNSF-40430 for older versions. The advisory lists the patch for each other product. Barracuda says to apply the patch manually if it was not applied automatically, and to turn automatic patching on.
- Check how far behind the firmware is. Barracuda notes that appliances several versions behind may need more than one update. Contact Barracuda Support if in doubt.
- Take the admin interface off the internet. Barracuda's advice is to restrict administrative interfaces to trusted internal networks. Organizations whose admin interface is not exposed, it says, are less exposed to this attack path.
- Review who has admin accounts on the appliance, and change any shared or default passwords once it is patched.
- If the appliance was exposed and unpatched after November 2, treat it as possibly compromised and have it checked rather than simply patching and moving on.
Neither Barracuda nor CISA has published indicators of compromise so far, so watch the advisory for updates.
Need a hand?
Email is one of the main ways attacks reach small businesses, so the systems that filter it need the same care as the firewall. Our phishing and email security service covers mail filtering and the settings around it, and our cybersecurity services include checking what your network exposes to the internet. If you would like us to check a Barracuda appliance, call (213) 986-4855.