Attackers chain two Barracuda email gateway flaws to get root access, a week after the fix
November 9, 2026 (Fixed November 2, exploited by November 9, 2026)
Barracuda released fixes on November 2 for two flaws in its security appliances. The first (CVE-2026-116606) is an authentication weakness in the Email Security Gateway (ESG) that lets an attacker change the appliance's global configuration. The second (CVE-2026-111560) lets an attacker inject operating-system commands that run as root, and it affects the ESG as well as the Load Balancer ADC, Message Archiver, WAF Control Center, Web Application Firewall and Web Security Gateway. On the evening of Monday, November 9, Barracuda updated its advisory to say the two are being exploited together against a small number of organizations, without giving a number. Exploitation needs access to the appliance's administrative interface. CISA added both flaws to its exploited-vulnerabilities list on November 10. The ESG patches are BNSF-40425 for version 9.4.017 and later and BNSF-40430 for older versions. Barracuda has not named the attackers. Earlier ESG flaws were exploited in 2023 by a group tracked as UNC4841.
Why it matters
An email gateway sees every message a company sends and receives, so root access to it is valuable to attackers. The fix existed a week before the attacks, and the deciding factor is whether the admin interface can be reached from the internet.
What defenders can take from it
- ESG owners: confirm the patch is actually installed, apply it by hand if it was not applied automatically, and turn automatic patch delivery back on if it was off.
- Allow the administrative interface only from trusted internal networks.
- Patch the other listed Barracuda products for CVE-2026-111560 too, and review appliances for configuration changes you did not make.