If your business runs a Barracuda Email Security Gateway — or any of the company's security appliances — this week is the week to check the firmware. Barracuda has confirmed that attackers are now exploiting two flaws that, used together, can give an attacker full control of the device, without even needing a login.
The flaws were patched on 2 November. But on 9 November, Barracuda said it had "identified exploitation activity affecting a small number of organizations." The next day, the US Cybersecurity and Infrastructure Security Agency (CISA) added both flaws to its Known Exploited Vulnerabilities catalogue — the list of flaws being exploited in the real world — and gave US federal agencies until 13 November, tomorrow, to fix them. That deadline applies to federal agencies, not to every business, but the fix is already available, and the flaws are already being exploited.
The Two Flaws, Explained Simply
Flaw One: A Way In Without a Login
The first flaw is CVE-2026-116606, an authorization bypass in the Barracuda Email Security Gateway (ESG), scoring 9.3 out of 10 for severity.
In plain terms, it lets an attacker who can reach the gateway's admin page call a configuration-import function and restore a crafted backup file — without logging in at all. That backup can change the appliance's global settings. Barracuda first listed this flaw as needing administrative access; on 5 November it corrected that, saying no login is needed, only access to the admin interface. It affects ESG versions before 9.4.0.030.
Flaw Two: A Command Injection in the Timezone Setting
The second flaw is CVE-2026-111560, a command injection flaw scoring 8.6 out of 10, sitting in the timezone configuration setting in code shared across six Barracuda products. An administrator who sets a crafted timezone value can end up running operating-system commands — and those commands run with root privileges, the highest level of access on the device.
On its own, this flaw needs an attacker to already be an administrator. That is what makes the first flaw so dangerous: it can supply the access the second one needs.
How the Two Chain Together
Chained, the attack is simple. The attacker reaches the ESG admin page, uses the bypass to import a crafted backup and take control of the configuration, then uses the command injection to turn that control into full root access — the keys to a device that filters every email coming in.
There is one important limit. The attack needs access to the product's administrative interface; it cannot start from a mailbox or a web form. If your admin page is only reachable from inside your office network or over a VPN, the risk is much narrower. If it is exposed to the internet, it is not.
How the Story Developed
2 November 2026: Barracuda publishes its advisory and releases patches for both flaws. No exploitation has been reported.
5 November: Barracuda corrects the advisory — the bypass needs no login, only access to the admin page.
9 November: Barracuda says exploitation has been seen affecting "a small number of organizations," without naming them or saying what the attackers did after getting in.
10 November: SecurityWeek reports that threat actors have started exploiting the flaws, and CISA adds both to its Known Exploited Vulnerabilities catalogue, with a due date of 13 November and forensic triage marked "Yes" — check for signs of compromise, not just patch.
11 November: Security researchers report continued attempts against the bypass flaw: 17 attempts from 15 internet addresses between 9 and 11 November.
CISA's entries reference research from watchTowr Labs and Mandiant.
Which Products Are Affected
The bypass flaw affects only the Email Security Gateway. The command injection flaw affects six product lines: the Email Security Gateway (before firmware 9.4.0.030), Load Balancer ADC (before 6.4.0), Message Archiver (before 5.5.4.0), Web Application Firewall (before 11.0.1), WAF Control Center (before 2.2.1), and Web Security Gateway (before 16.1.100.100).
For the ESG, firmware 9.4.0.029 includes the patches — check the version under Advanced, then Firmware Update. Appliances below firmware 9.1 may need to update in two steps. For the other products, Barracuda lists patch identifiers: BNSF-40425 or BNSF-40430 for the ESG, BNADC-16586 for the ADC and WAF, BNMA-32468 for the Message Archiver, BNWF-60060 for the WAF Control Center, and BNYF-24789 for the Web Security Gateway. If a patch has not applied itself automatically, apply it manually as soon as possible.
Why Email Gateways Are Such a Tempting Target
This is not the first time Barracuda's email gateway has been in this position. In 2023, a flaw in the same product, CVE-2023-2868, was exploited from as early as October 2022. Mandiant said about 5 percent of ESG appliances worldwide were compromised, and affected customers were told to replace their devices. That flaw was exploited through malicious emails, with no admin access needed — but it showed how attractive email gateways are to attackers: they sit at the edge of the network, handle every message, and are trusted by everything behind them.
What to Do Today
If you run any of the affected products, here is the short checklist.
Patch the firmware. For the ESG, update to 9.4.0.029 or later. For the other products, apply the patch Barracuda lists for your model. Turn automatic patching back on if it has been switched off.
Check whether your admin page is on the internet. If it is, restrict it to trusted internal networks or a VPN.
Look for signs of compromise. CISA marked both flaws for forensic triage, so patching alone is not the whole job. Check the configuration-import and restore history on any exposed device, and look for unexpected changes or new administrator accounts.
Check the people, not just the box. Make sure the people who manage the gateway use strong, unique passwords and two-step verification to protect your online accounts.
If you find anything odd, treat it as a breach. Contact Barracuda support and your security team before you patch over the evidence.
What If You Do Not Run Barracuda?
Most readers will not have a Barracuda appliance, but the pattern repeats with every vendor: a flaw is disclosed, a patch is released, and the window between the two is when attackers move fastest. The same week, Microsoft patched more than 1,000 flaws, including an Outlook flaw already being exploited — patch quickly, and keep admin pages off the public internet. Many small businesses now run email through cloud computing services, where the provider handles patching — if that is you, keep your own accounts locked down and turn on two-step verification.
The Bottom Line
Two flaws, patched on 2 November, confirmed as exploited on 9 November, and on CISA's exploited list on 10 November, with a federal fix deadline of 13 November. If you run a Barracuda appliance, check the firmware version today, apply the patch, and make sure the admin page is not sitting on the open internet. The fix exists, and the attackers are already using the flaw. The only question is whether the patch goes on before they reach you.
Sources: Barracuda Networks advisory, 2 November 2026 (updated 5 and 9 November); CISA Known Exploited Vulnerabilities catalog, 10 November 2026; Canadian Centre for Cyber Security advisory AV26-1112.
