Barracuda warns attackers exploit two patched Email Security Gateway flaws for root access

On Nov. 10, 2026, Barracuda Networks warned that attackers are actively exploiting two patched Email Security Gateway flaws to obtain root access.

Barracuda said on Monday evening, “We have identified exploitation activity affecting a small number of organizations.” The company identified the flaws as CVE-2026-116606 and CVE-2026-111560. Chaining the two vulnerabilities lets an attacker obtain root access on the gateway. Barracuda stated that successful exploitation requires access to the administrative interface and that combined exploitation could bypass authorization controls and obtain root access.

The CVE-2026-116606 pre-authentication authorization bypass affects only the Email Security Gateway and carries a CVSS score of 9.3. CVE-2026-111560 is a command injection flaw that reaches the Email Security Gateway and five other Barracuda products and carries a CVSS score of 8.6. Mandiant assigned the two CVE records. Barracuda rates both vulnerabilities as high severity despite the 9.3 score for the bypass.

Barracuda’s advisory describes CVE-2026-116606 as pre-authentication yet also lists administrative access as required, leaving the authentication question unclear. Mandiant says the Email Security Gateway bug is exploitable without authentication. Barracuda corrected its advisory on Nov. 5, 2026 to state that the bypass does not require authentication, while stressing that an attacker still needs access to the administrative interface.

The attack chain works by leaving a backup-restore function reachable without login after a failed password change, then running restored timezone data as a root shell command, with Barracuda’s backup checksum secret built into the code. CVE-2026-116606 lets an unauthenticated attacker restore a crafted configuration backup and change global settings. CVE-2026-111560 executes commands as root through a timezone setting and normally requires administrator access.

Barracuda issued patches for both flaws on Monday, Nov. 2, 2026. Patch BNSF-40425 covers firmware 9.4.017 and newer; BNSF-40430 covers older versions. The authentication bypass affects versions earlier than 9.4.0.030, invoking a configuration-import function to restore a crafted backup archive and change global configuration.

Appliances running several firmware versions behind might need more than one update to become fully patched. Administrators should confirm each appliance runs current firmware and that patches installed successfully. Customers should manually apply patches if automatic updates failed to install them, Barracuda advised, and those who turned off automatic patching should switch it back on.

Barracuda urged customers to restrict administrative interfaces to trusted internal networks and to apply network access controls. The command injection flaw also reaches the Load Balancer Application Delivery Controller, Message Archiver, WAF Control Center, Web Application Firewall, and Web Security Gateway.

Product-specific patch IDs are BNADC-16586 for ADC and WAF, BNMA-32468 for Message Archiver, BNWF-60060 for WAF Control Center, and BNYF-24789 for Web Security Gateway. Barracuda Support can help verify firmware and patch status.

The company’s advisory does not confirm exploitation in the wild. Earlier reporting uncovered no public evidence tying the flaws to attacks. CISA’s Known Exploited Vulnerabilities catalog did not list either flaw as of early November 2026. The disclosure reports no attacks, Barracuda has not said anyone exploited either flaw, and it provides no count of affected devices.

According to Frank Dickson of Dickson Research, root access on an e-mail gateway exposes message flow and credentials for mail servers and directories. Dickson called mail-gateway credentials and connections “Those are the keys to the kingdom, if you will.”

Dickson advised taking e-mail-gateway admin interfaces off the internet and verifying patches installed successfully, then reviewing admin logs, checking for unfamiliar accounts, and watching for unexpected outbound connections. Jon Nelson of Infotech said evaluating the two flaws separately understates the danger because their chaining is the principal worry, and that placing admin interfaces directly on the internet was always a mistake.

E-mail gateways face the internet by design, carry sensitive traffic and credentials, generally cannot run endpoint detection tools, and run identical firmware, meaning one exploit can scale to thousands of customers, Dickson said. Dickson advised buyers to ask vendors whether the admin interface is internet-exposed by default, how quickly patches ship, whether patching is automatic, and what logging users can see.

UNC4841 exploited zero-day CVE-2023-2868 against Barracuda Email Security Gateway appliances, with activity starting in October 2022. The group also exploited zero-day CVE-2023-7102 to execute arbitrary code on the appliances. Barracuda said the CVE-2023-7102 flaw remained a zero-day exploit for at least seven months, with activity dating back to at least October 2022. The older flaw is unrelated to the newly disclosed vulnerabilities.

The exploitation deployed SeaSpy and Saltwater malware and stole data. Mandiant said nearly a third of systems breached in the 2023 campaign belonged to government agencies, most hacked between October and December 2022.

Barracuda instructed customers with compromised Email Security Gateway appliances in 2023 to replace them outright instead of relying on the patch. Frank Dickson said a patch fixes the lock but does not tell you who already has a key. Founded in 2003, Barracuda has more than 200,000 customers worldwide.

Daily Security Review places disclosure on November 3, 2026. Cyber Security News dates it to November 2, 2026.

Mandiant said Barracuda reported the command injection flaw on October 15, 2026, followed by the authentication bypass on October 22, 2026. On Thursday, November 5, 2026, watchTowr detailed the attack chain and released a vulnerable-appliance detection tool, though it did not publish an exploit. Barracuda corrected its advisory on November 5, 2026 to state that CVE-2026-116606 does not require authentication, while an attacker still needs access to the administrative interface.

Barracuda researchers, not a malware strain, identified the two vulnerabilities. The advisory reports no active exploitation or attack campaign and withholds vulnerable endpoints, example requests, payloads, and a detailed exploit sequence.

Administrators should apply patches, verify patching, and watch for suspicious root or e-mail-gateway activity. Barracuda identifies version 9.4.0.030 and later as the fixed Email Security Gateway firmware.