Barracuda has confirmed that security flaws in its Email Security Gateway, also known as ESG, are being actively exploited. The company said on November 9, 2026, in an update issued at 9:00 p.m. EST that the activity affected a small number of organizations, and that attackers could combine two vulnerabilities to gain root access without logging in.
Exposure at the management interface
The two tracked issues are CVE-2026-116606 and CVE-2026-111560. One is an authorization bypass and the other is a command injection flaw, and both relate to ESG. Barracuda said successful exploitation requires access to the appliance’s administrative interface, which makes exposed management pages a concern. It also said organizations that keep their interfaces off the public internet are less exposed to this attack path.
Barracuda’s latest advisory changed the picture from the initial November 2 disclosure. Cybersecurity News had already covered the flaws and the available patches before Barracuda reported active attacks. The advisory does not identify the attackers, the affected organizations, any malware, or the exact number of victims.
How the two flaws line up
CVE-2026-116606 is a pre-authentication authorization bypass affecting ESG and carries a CVSS score of 9.3. Barracuda corrected its advisory on November 5 to clarify that attackers do not need valid credentials. They still need to reach the administrative user interface, so network access and authenticated access are separate requirements.
CVE-2026-111560 is a command injection flaw with a CVSS score of 8.6. On its own, it requires administrative access. Barracuda said combining it with the authorization bypass could remove that login barrier and give root access to the device. ESG is the only listed product affected by both vulnerabilities, so the unauthenticated chain should not be assumed to apply to every listed product.
Vendor guidance and patch coverage
Barracuda’s updated security advisory rates both flaws as High. Its public guidance confirms the combined root-access risk, but it does not provide exploit requests or a detailed attack sequence. That leaves defenders with limited information about the methods used in the observed incidents.
ESG customers need BNSF-40425 for version 9.4.017 and later, or BNSF-40430 for earlier versions. The command injection flaw also affects Load Balancer Application Delivery Controller and Web Application Firewall, which are patched through BNADC-16586. Message Archiver requires BNMA-32468, WAF Control Center requires BNWF-60060, and Web Security Gateway requires BNYF-24789. These products serve different roles, so checking patch coverage depends on accurate device inventories.
Barracuda recommends restricting administrative interfaces to trusted internal networks and applying network access controls. Customers should verify that the latest firmware and every applicable security patch are installed. Devices several versions behind may need multiple updates, missing patches may need to be installed manually, and automatic patching should be enabled where it is disabled.
Email Security Gateway guide | Email security gateway guide | screening messages and attachments
Licensed under CC BY-ND 4.0 International