Barracuda Networks has updated its security advisory to say that two flaws it patched on November 2 are now being exploited. Its note, added on the evening of November 9 (9:00pm EST), reads: “We have identified exploitation activity affecting a small number of organizations.” Barracuda has not said who is behind the attacks or what they did on compromised devices.
The two flaws are CVE-2026-116606, an authorization bypass in the Email Security Gateway (ESG) that lets an attacker change the appliance’s global configuration, and CVE-2026-111560, a command injection that runs commands as root. Chained, they give root access to the device. Barracuda says exploitation requires access to the appliance’s administrative interface. When we first covered the patches in Barracuda Patches Flaws That Chain to Root on Email Gateways, neither Barracuda nor BleepingComputer reported exploitation; this update changes that.
One detail changed on November 5: Barracuda corrected the “Authentication Required” field for CVE-2026-116606 to “No (Administrative UI Access Required)”. In other words, the attacker needs no login, but does need to be able to reach the admin interface.
How to check if you’re affected
Affected products, per Barracuda’s advisory, are the Email Security Gateway (both CVEs) and, for CVE-2026-111560 only, the Load Balancer ADC, Message Archiver, WAF Control Center, Web Application Firewall and Web Security Gateway. The patch for each:
| Product | Patch |
|---|---|
| Email Security Gateway | BNSF-40425 (firmware 9.4.017 and later) or BNSF-40430 (versions before 9.4.017) |
| Load Balancer ADC | BNADC-16586 |
| Message Archiver | BNMA-32468 |
| WAF Control Center | BNWF-60060 |
| Web Application Firewall | BNADC-16586 |
| Web Security Gateway | BNYF-24789 |
Barracuda says the device shows the latest available firmware version, and that a device several versions behind may need more than one update. If a patch was not applied automatically, apply it manually; if automatic patching is off, Barracuda recommends turning it on. It also recommends limiting access to the administrative interface to trusted internal networks, noting that organizations whose admin interfaces are not reachable from the internet are less exposed. Support is at support@barracuda.com, and manual patching guidance is on Barracuda Campus.
Barracuda’s advisory does not publish indicators of compromise. If an admin interface of an affected device was reachable from untrusted networks before patching, treat that as a reason to ask Barracuda Support whether the device should be checked; this suggestion is ours, not the vendor’s.