Barracuda Email Security Gateway flaws under attack: patch now

Barracuda says attackers have used two flaws in its Email Security Gateway (ESG) against a small number of organisations, and the US agency CISA added both to its list of exploited holes on 10 November 2026. Used together, they can give an attacker root control of the appliance. If your company's email passes through a Barracuda ESG, ask whoever manages it to confirm today that Barracuda's patch is installed.

What is the problem?

The Email Security Gateway is a box, real or virtual, that sits in front of your mail server and filters spam and viruses. Barracuda published two CVEs for it on 2 November 2026 and updated its advisory on 9 November after it saw attacks.

• CVE-2026-116606 (CVSS 9.3) lets someone who is not logged in change the gateway's whole configuration by loading a crafted backup file. NVD lists ESG versions earlier than 9.4.0.030 as affected.
• CVE-2026-111560 (CVSS 8.6) lets an admin run system commands as root through the time zone setting. It also affects the Barracuda Load Balancer ADC, Message Archiver, Web Application Firewall, WAF Control Center and Web Security Gateway.

Barracuda says the attacker needs to reach the admin web page of the device. Boxes whose admin page is open to the internet are the ones most at risk. CISA has given US government agencies until 13 November 2026 to act.

What to do

1. Ask your IT vendor or whoever manages the Barracuda box to check the firmware version and confirm the patch is in. For ESG, Barracuda lists patch BNSF-40425 for firmware 9.4.017 and newer, and BNSF-40430 for older firmware.
2. Check that automatic patching is turned on. Barracuda says that if it was turned off, the patch must be put on by hand as soon as possible, and it recommends switching automatic patches back on.
3. If the firmware is several versions behind, more than one update may be needed. Barracuda Support can help at support@barracuda.com.
4. Make sure the admin page cannot be reached from the internet. Barracuda advises allowing it only from trusted internal networks.
5. Ask the manager to look for changes nobody made: new admin accounts, different mail routing or relay settings, or filtering rules switched off.
6. For the next few weeks, watch for strange mail: spam that suddenly gets through, mail that should arrive but does not, or reports from customers about odd emails sent in your name. Tell your vendor straight away if you see any of these.

If you also use any of the other Barracuda products listed above, the same checks apply to them.

How SyncTech can help

If you are reviewing how your company's mail is filtered, our spam-filtered email hosting page explains the mail filtering we offer.

Source and credit

We are sharing this news from Barracuda Networks, CISA and NIST. This summary is written by Synctech in our own words.

• Pre-Authentication Authorization Bypass and Command Injection Vulnerabilities in Certain Barracuda Products, Barracuda Networks, 2 November 2026 (updated 9 November 2026): https://trust.barracuda.com/security/pre-authentication-authorization-bypass-command-injection
• Known Exploited Vulnerabilities Catalog, CVE-2026-116606 and CVE-2026-111560, CISA, 10 November 2026: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• CVE-2026-116606 Detail, NIST National Vulnerability Database, 2 November 2026: https://nvd.nist.gov/vuln/detail/CVE-2026-116606
• CVE-2026-111560 Detail, NIST National Vulnerability Database, 2 November 2026: https://nvd.nist.gov/vuln/detail/CVE-2026-111560

Retrieved 11 November 2026. Barracuda is a trademark of Barracuda Networks Inc. Synctech is not connected with them. This is general information, not legal, tax or financial advice. If anything here is wrong, email support@synctech.com.my and we will correct it.