Barracuda Networks: exploited vulnerabilities and priority patches

3 exploited vulnerabilities in the catalog
2 added in the last 12 months
0 used by ransomware
3 products affected

Affected products

Barracuda Email Security Gateway (ESG)1
Email Security Gateway (ESG) Appliance1
Multiple Products1

Our analyses

Barracuda: two email gateway flaws patched November 2 are already being exploited

The November 2 patches cover six products. Since November 9, Barracuda has reported attacks against "a small number of organizations." The US agency CISA lists the flaws as exploited: here is what to check.

Nov 4, 20263 min read

All exploited vulnerabilities

CISA KEV catalog, newest first: each entry corresponds to observed exploitation.

2026 2 vulnerabilities

CVE-2026-116606added Nov 10

Barracuda Networks Email Security Gateway (ESG) Authentication Bypass Using an Alternate Path or Channel Vulnerability
Mentioned in our article: Barracuda: two email gateway flaws patched November 2 are already being exploited
NVD entry CISA catalog
CVE-2026-111560added Nov 10

Barracuda Networks Multiple Products OS Command Injection Vulnerability
Mentioned in our article: Barracuda: two email gateway flaws patched November 2 are already being exploited
NVD entry CISA catalog

2023 1 vulnerability

CVE-2023-2868added May 26 2023

Barracuda Networks ESG Appliance Improper Input Validation Vulnerability
Mentioned in our article: Barracuda: two email gateway flaws patched November 2 are already being exploited
NVD entry CISA catalog

What to do

If your estate includes any of these products, make sure the vendor’s patches are applied, starting with the most recent vulnerabilities and those used by ransomware, then look for signs of compromise: an exploited vulnerability has often been used before it was fixed.

Additions from all vendors are tracked on the Actively exploited vulnerabilities page, updated several times a day. Sources: CISA KEV catalog (US public domain) and CERT-FR.