Barracuda has confirmed that attackers are exploiting two flaws in its email security appliances, and chained together they hand over root. Both were patched on 2 November 2026, a week before the exploitation notice, and both are now on CISA's Known Exploited Vulnerabilities catalog.
What happened
The pair is CVE-2026-116606, a pre-authentication authorization bypass rated CVSS 9.3 in the Email Security Gateway, and CVE-2026-111560, an OS command injection rated CVSS 8.6 that affects six Barracuda products.
The first flaw lets an unauthenticated remote attacker reach a configuration import function and restore a crafted backup archive, rewriting the appliance's global configuration. The second lets an attacker with administrative access inject commands that run as root. Barracuda's wording is worth reading twice: authentication is not required for the bypass, but the administrative interface has to be reachable by the attacker. That is why the advisory leads with network access control rather than patching alone.
In a 9 November update to its advisory, Barracuda said it had identified exploitation activity affecting a small number of organisations. The company has not published attacker details. Three years ago a different Email Security Gateway zero-day was used by a Chinese-linked group for espionage on government mail servers for at least seven months, which is the reason this product class gets watched closely.
Who is affected
- Email Security Gateway (ESG) appliances below patch level 9.4.017: both CVEs apply.
- Load Balancer ADC and Web Application Firewall: command injection only, patched by BNADC-16586.
- Message Archiver (BNMA-32468), WAF Control Center (BNWF-60060) and Web Security Gateway (BNYF-24789): command injection only.
- Any deployment where the appliance's administrative interface answers from the public internet.
What to do now
Apply the named patch, then restrict the administrative interface to trusted internal networks or a management VPN. Barracuda states that appliances whose admin interfaces are not internet-reachable are materially less exposed.
- Confirm the running firmware version on the device itself rather than trusting an asset register. Appliances several versions behind may need more than one update.
- Turn automatic patching back on if it was disabled, and do not rely on a scheduled window for this one.
- Check for configuration changes and admin accounts you cannot explain, going back to early November.
- Review mail flow rules and outbound relay settings for tampering, since a rewritten global configuration is exactly the position an attacker wants for mail interception.
What this means for South African businesses
Email gateways are one of the few security products where a South African SME is directly exposed, because these appliances sit on the public internet by design to receive mail, and their admin panels are often published on the same address because that is how the installer left it. Our judgment is that the patch is the easy half: an appliance that quietly restored a foreign configuration file has already lost integrity, and mail interception is a business email compromise problem long before it is a root problem. Treat any hit as a mail-integrity incident, not a firmware ticket.
Source: Barracuda Networks security advisory - pre-authentication authorization bypass and command injection. Exploitation was reported by BleepingComputer.
Also on the blog
Next step: If this is on your network or a client's, ask Matthews Enterprises to check exposure.