Barracuda: two email gateway flaws patched November 2 are already being exploited

In 2023, Barracuda discovered that a flaw in its email gateways, the appliances that filter companies' emails, had been exploited since at least October 2022 for espionage. According to Mandiant, nearly a third of the compromised devices belonged to government agencies. Three years later, the vendor is again asking customers to check their updates.

On November 2, 2026, Barracuda published an advisory covering two flaws. Combined, they could allow an attacker to bypass authorization controls and gain root access, meaning full control of the device. No exploitation was reported at that stage, and patches exist for all six affected products.

Two flaws, six products

• CVE-2026-116606 affects only the Email Security Gateway (ESG), the email gateway. Barracuda describes it as a pre-authentication authorization bypass. According to BleepingComputer, it allows the appliance's global configuration to be modified. Severity score: 9.3 out of 10.
• CVE-2026-111560 allows command injection that runs with root privileges. It affects the ESG, but also the Load Balancer ADC, the message archiver (BMA), the web application firewall (WAF) and its WAF Control Center console, as well as the WSG web gateway. Score: 8.6 out of 10.

Despite the first flaw's 9.3 score, Barracuda rates both flaws as "high" severity, not "critical."

Does an attacker need an account?

The advisory is ambiguous. The name of the first flaw suggests a bypass before any authentication, but Barracuda's table says that administrator access is required for both. One sentence, however, leaves no doubt: the attacker must be able to reach the product's administration interface. Appliances whose interface is reachable from the Internet are therefore the most exposed.

What should you do?

Patches are normally applied automatically. Barracuda asks customers to make sure of it:

• ESG: patch BNSF-40425 for versions 9.4.017 and later, BNSF-40430 for earlier versions;
• Load Balancer ADC and WAF: BNADC-16586; BMA: BNMA-32468; WAF Control Center: BNWF-60060; WSG: BNYF-24789;
• if the patch was not applied automatically, install it manually as soon as possible, and re-enable automatic updates if they had been turned off;
• if the firmware is several versions behind, plan for several successive updates, with help from support if needed;
• restrict the administration interface to trusted internal networks.

These appliances attract attackers. In October, an already-exploited flaw also affected Cisco's email gateway, which a booby-trapped email could be enough to compromise. At Barracuda, the 2023 flaw (CVE-2023-2868) was used by the group UNC4841 to install the SeaSpy and Saltwater spyware, and another (CVE-2023-7102) was exploited by the same group before it became public. It remains to be seen whether the November flaws will attract such visitors again.

Update of November 12, 2026

The two flaws Barracuda patched on November 2 are now being exploited. Both affect its ESG (Email Security Gateway); one of them, CVE-2026-111560, also affects five other products. On the evening of November 9, the vendor added a mention of "exploitation activity" affecting "a small number of organizations" to its security advisory. According to SecurityWeek, neither Barracuda nor CISA, the US cybersecurity agency, has given details about these attacks. The site cites the company Previdian, which recorded 17 attempts targeting CVE-2026-116606 between November 9 and 11, from 15 IP addresses located in three countries.

On November 10, CISA added CVE-2026-116606 and CVE-2026-111560 to its catalog of actively exploited vulnerabilities (KEV, for Known Exploited Vulnerabilities). US federal civilian agencies have until November 13 to patch. The catalog also asks them to examine the devices, to verify they were not compromised before the update.

Barracuda has also resolved the ambiguity over authentication. It revised its advisory on November 5: for CVE-2026-116606, the "authentication required" line now reads "no (access to the administration interface required)," instead of "yes, administrator access." The attacker therefore does not need an account: they only need to be able to reach the appliance's administration interface. CVE-2026-111560 still requires administrator privileges. According to Barracuda, the two flaws, chained together, could allow an attacker to gain root access to the device. The vendor recommends verifying that the patches are properly installed and restricting the administration interface to trusted internal networks.