Published 11 November 2026 · Rathish Kumar, Invitty

On 9 November 2026 Barracuda confirmed that attackers are exploiting two Email Security Gateway (ESG) flaws, CVE-2026-116606 (CVSS 9.3) and CVE-2026-111560 (CVSS 8.6), at a small number of organisations. Used together they give an attacker root on the appliance without a password, provided the admin web interface is reachable. Install patch BNSF-40425 (firmware 9.4.017 or later) or BNSF-40430 (older firmware) today, then take the admin interface off the internet.

What changed between 2 and 9 November?

Barracuda published the advisory and the patches on 2 November. At that point CVE-2026-116606, the authorization bypass, was listed as needing administrative access, which made it look like a problem only for someone who already had a login. On 5 November Barracuda corrected that field. The bypass now reads "No (Administrative UI Access Required)", meaning an attacker needs to reach the admin page, not to know a password. Four days later, on the evening of 9 November US Eastern time (early morning of 10 November in India), Barracuda added that it had seen exploitation activity. CISA put both CVEs in its Known Exploited Vulnerabilities catalogue on 10 November.

That sequence matters. A flaw that needs admin credentials goes into the next maintenance window. A flaw that needs only network reach to a login page, and is already being used, goes in tonight. If your team read the 2 November notice and parked it, reopen the ticket.

What Barracuda has not said is just as relevant: it has not named the attackers, given a victim count beyond "a small number", or published indicators of compromise. BleepingComputer, which reported the update on 10 November, notes the same gaps.

Which Barracuda products are affected?

Only the Email Security Gateway is exposed to both flaws, so only the ESG is open to the full root-access chain. Five other product lines carry the command injection bug on its own, which still needs administrative access to use.

Barracuda products in the advisoryScroll to see all columns →
ProductCVE-2026-116606CVE-2026-111560Patch ID
Email Security GatewayYesYesBNSF-40425 (9.4.017 and later), BNSF-40430 (before 9.4.017)
Load Balancer ADCNoYesBNADC-16586
Message ArchiverNoYesBNMA-32468
WAF Control CenterNoYesBNWF-60060
Web Application FirewallNoYesBNADC-16586
Web Security GatewayNoYesBNYF-24789

Barracuda maps patches to firmware versions only for the ESG. For the other five lines, the advisory simply says to run the latest firmware with all security patches applied.

How to check whether your gateway is exposed

  1. Firmware and patch. Log in to the appliance and note the firmware version it reports, along with the latest version it says is available. That tells you which of the two ESG patches applies. Barracuda says some units received the patch automatically; confirm it rather than assume it.
  2. Automatic patching. If someone switched automatic patching off during a past upgrade, Barracuda asks you to switch it back on.
  3. Who can reach the admin page. Check your perimeter firewall for NAT or port-forward rules that publish the ESG's web interface. Then test from outside the office, for example from a phone on mobile data. If the login page loads, the appliance is exposed to the full chain.
  4. Third-party access. Many Indian SMBs let a support partner manage the gateway over a public IP allow-list. Find out whether that allow-list is tight or was opened wide "temporarily" years ago.

What to do, in order

First, apply the patch. If it is already applied, write down when, because you will need that date for the next step. Second, restrict the admin interface to a management VLAN or to users connected over your VPN, which is what Barracuda recommends. Third, look back. Exploitation has been confirmed and the result is root, so a patched appliance is not automatically a clean one. Without published indicators, the realistic review for a small IT team is:

  • admin logins from unfamiliar IP addresses since late October;
  • new or modified administrator accounts;
  • changes to mail routing, relay hosts or forwarding rules that nobody in your team made;
  • outbound connections from the appliance to hosts you do not recognise, taken from your firewall logs.

If any of that turns up, treat it as an incident. Rotate the credentials the gateway stores, such as the LDAP bind account and any SMTP relay passwords, and open a case with Barracuda support. Indian organisations should also remember that CERT-In's 2022 directions require certain incidents to be reported within six hours of noticing them, so bring in whoever owns that process early rather than after the clean-up.

Why attackers keep coming back to email gateways

This is not the first time an ESG has been targeted. In 2023 a group tracked as UNC4841 exploited CVE-2023-2868 for espionage, and Barracuda later said that activity went back to at least October 2022. Mandiant found that almost a third of the organisations breached in that campaign were government bodies.

The reason is simple. A mail gateway sees every inbound message, often holds directory credentials, and usually sits half inside the network. Root on that box is a very good observation post. Our view: any appliance that handles mail for the whole company deserves the same patch discipline as the main firewall, and in many offices we visit it gets far less.

What this means for renewals and budgets in India

Barracuda has more than 200,000 customers. The ESG owners we meet in India are often SMBs who bought the appliance years ago and have renewed its subscription without much thought since. This week is a good time to check three things: that the subscription delivering firmware and security updates is active, that someone owns patching for the appliance, and when the next renewal falls due.

If renewal is close, it is reasonable to ask whether an on-premises gateway still suits you or whether cloud email security would be simpler to keep patched. We would not make that decision in a panic, and we would not assume either route is cheaper until you compare like-for-like quotes with GST invoices. Our email security comparison covers the main options we supply.

Questions Barracuda ESG owners are asking

Our ESG admin page is only reachable from the office LAN. Do we still need to patch?
Yes. Barracuda says appliances without an internet-facing admin interface face lower exposure, but anyone who can reach that page from inside your network, including a compromised PC, can still attempt the chain. Apply the patch and keep the restriction in place.
We use Barracuda's cloud email protection, not an appliance. Are we affected?
The advisory's product table lists Email Security Gateway, Load Balancer ADC, Message Archiver, WAF Control Center, Web Application Firewall and Web Security Gateway. A cloud-only email service is not in that table. Confirm with Barracuda support or your partner which product you actually run before you close the ticket.
Is there a workaround if we cannot patch today?
Barracuda's remediation is the firmware patch. Restricting the admin interface to trusted internal networks lowers exposure but does not remove the flaws, so treat it as a stopgap for hours, not weeks.
Has Barracuda published indicators of compromise?
Not as of 11 November 2026. Barracuda has said a small number of organisations were affected, but it has not named the attackers or shared indicators, so the practical check is a review of admin logins and configuration changes since late October.

Next step

Send us the appliance model, the firmware version it reports and how its admin page is published, and we will confirm which patch applies, test from outside whether the login page is reachable, and help you read the admin logs. If the subscription is due, we can also line up the renewal date and quote. More on what we support is on our Barracuda partner page and the licence renewals page.