Barracuda has confirmed that its Email Security Gateway (ESG) line is under active attack due to two serious vulnerabilities that, when chained together, let adversaries gain root-level access without authenticating. These flaws were officially acknowledged in Barracuda’s November 9, 2026 advisory and have already impacted a limited number of organizations. The vulnerabilities are known as CVE-2026-116606 and CVE-2026-111560. The first enables an authorization bypass, allowing attackers to operate without valid credentials, while the second is a command injection flaw normally requiring admin access. Together, they can completely compromise ESG systems.
Details of the Flaws and Their Impact
The first vulnerability, CVE-2026-116606, carries a high severity score of 9.3 and permits access to the administrative interface without prior login. Barracuda clarified on November 5 that valid credentials are not needed. However, network reachability of the ESG’s admin interface remains a hard requirement. One alone does not grant full control.
The second flaw, CVE-2026-111560, allows command injection with a high severity rating of 8.6. Ordinarily, an attacker would need administrator-level permissions for this to be exploitable. But when used in tandem with the authorization bypass, the chain effectively sidesteps login controls entirely, granting root access.
While ESG products are the only ones confirmed to be affected by both of these flaws, one should not assume all Barracuda appliances are at equivalent risk. Other products do receive coverage for one flaw or the other, and so they need their own specific updates.
Patching, Mitigation, and Risk Reduction
Barracuda has released patches for multiple product versions. ESG devices on version 9.4.017 or newer should install patch BNSF-40425; older versions require BNSF-40430. Related appliances—such as the Load Balancer Application Delivery Controller and Web Application Firewall—are addressed via patch BNADC-16586. Additional patches apply to the Message Archiver, WAF Control Center, and Web Security Gateway under identifiers BNMA-32468, BNWF-60060, and BNYF-24789 respectively.
To defend against exploitation, organizations are urged to limit access to administrative interfaces—especially from public networks—and enforce robust network access controls. Confirming firmware and patch levels across all relevant devices is crucial. Barracuda also suggests enabling automatic updates where feasible, and manually applying fixes for devices that are several versions out of date.
Earlier in November, Barracuda had disclosed these vulnerabilities but had not yet confirmed any active exploitation. The new advisory shifts that assessment: attacks are now confirmed, though details about attackers, malware used, or the scale of impacted organizations remain vague.
This incident underscores the central role that email gateways play in enterprise security defenses. These appliances are front-line filters for messages, attachments, and phishing threats. When they fail, the consequences ripple throughout organizational networks.
Analysis: What makes this case especially dangerous is the chaining of two separate flaws—the first removing authentication barriers, the second executing malicious payloads—allowing straight root access. In an era where threat actors target misconfigurations and exposed management consoles, this combo is alarm-triggering. The takeaway for security teams: inventory every appliance, patch aggressively, and lock down access points. Failing to do so isn’t just risky—it may already be catastrophic.
