Barracuda Email Security Gateway flaws prompt root-access warnings. Barracuda has confirmed that security flaws in its Email Security Gateway, also known as ESG, are being actively exploited. The company said on November 9, 2026, in an update issued at 9:00 p.m. EST that the activity affected a small number of organizations, and that attackers could combine two vulnerabilities to gain root access without logging in. Exposure at the management interface. The two tracked issues are CVE-2026-116606 and CVE-2026-111560. One is an authorization bypass and the other is a command injection flaw, and both relate to ESG. Barracuda said successful exploitation requires access to the appliance's administrative interface, which makes exposed management pages a concern. It also said organizations that keep their interfaces off the public internet are less exposed to this attack path. Barracuda's latest advisory changed the picture from the initial November 2 disclosure. Cybersecurity News had already covered the flaws and the available patches before Barracuda reported active attacks. The advisory does not identify the attackers, the affected organizations, any malware, or the exact number of victims. How the two flaws line up. CVE-2026-116606 is a pre-authentication authorization bypass affecting ESG and carries a CVSS score of 9.3. Barracuda corrected its advisory on November 5 to clarify that attackers do not need valid credentials. They still need to reach the administrative user interface, so network access and authenticated access are separate requirements. CVE-2026-111560 is a command injection flaw with a CVSS score of 8.6. On its own, it requires administrative access. Barracuda said combining it with the authorization bypass could remove that login barrier and give root access to the device. ESG is the only listed product affected by both vulnerabilities, so the unauthenticated chain should not be assumed to apply to every listed product. Vendor guidance and patch coverage. Barracuda's updated security advisory rates both flaws as High. Its public guidance confirms the combined root-access risk, but it does not provide exploit requests or a detailed attack sequence. That leaves defenders with limited information about the methods used in the observed incidents. ESG customers need BNSF-40425 for version 9.4.017 and later, or BNSF-40430 for earlier versions. The command injection flaw also affects Load Balancer Application Delivery Controller and Web Application Firewall, which are patched through BNADC-16586. Message Archiver requires BNMA-32468, WAF Control Center requires BNWF-60060, and Web Security Gateway requires BNYF-24789. These products serve different roles, so checking patch coverage depends on accurate device inventories. Barracuda recommends restricting administrative interfaces to trusted internal networks and applying network access controls. Customers should verify that the latest firmware and every applicable security patch are installed. Devices several versions behind may need multiple updates, missing patches may need to be installed manually, and automatic patching should be enabled where it is disabled. Email Security Gateway guide | Email security gateway guide | screening messages and attachments

Hackers now exploit critical Barracuda ESG flaws to gain root access. Nov 10, 2026 // 13:17 - Niko Dunn Cybersecurity company Barracuda Networks warned that attackers have begun exploiting two recently patched Email Security Gateway (ESG) vulnerabilities that let them run commands with root privileges. Barracuda released security updates to address the two flaws (tracked as CVE-2026-116606 and CVE-2026-111560) one week ago. The first stems from an Email Security Gateway (ESG) authentication weakness that can be exploited to modify an appliance's global configuration, while the second lets unauthenticated attackers inject OS commands that execute with root privileges. Barracuda also said that successful attacks require access to the administrative user interface (Admin UI) of targeted devices and advised customers to restrict access to trusted internal networks and use appropriate network access controls to limit exposure. "Successful exploitation requires an attacker to have access to the administrative interface of an affected product. If exploited in combination, these vulnerabilities could allow an attacker to bypass authorization controls and obtain root access to the device," the company explained. On Monday evening, Barracuda updated the initial advisory to warn admins that the two flaws are being exploited in attacks targeting a limited number of customers. "Barracuda immediately initiated a comprehensive remediation process and released security patches for affected products. We have identified exploitation activity affecting a small number of organizations," it warned. "If a patch has not been automatically applied, customers should manually apply the appropriate patch as soon as possible. If customers have turned off automatic patching, Barracuda recommends setting devices to automatically receive patches." The table embedded below lists all affected devices and available security patches. Three years ago, Barracuda patched another Email Security Gateway flaw (CVE-2023-7102) that the UNC4841 hacking group exploited in zero-day attacks to execute arbitrary code. The same year, UNC4841 abused another zero-day (CVE-2023-2868) to target Barracuda ESG appliances as part of a series of cyber-espionage attacks. The company later revealed that the flaw had been exploited as a zero-day for at least seven months, since at least October 2022, to drop previously unknown SeaSpy and Saltwater malware and steal data from compromised devices. According to cybersecurity firm Mandiant, almost a third of systems breached in the 2023 campaign belonged to government agencies, most of them hacked between October and December 2022. Barracuda was founded in 2003 and now has more than 200,000 customers worldwide, including small- to medium-sized businesses (SMBs), large enterprises, and managed service providers (MSPs).

Barracuda Email gateway flaws could give attackers root access. A pair of vulnerabilities in Barracuda's Email Security Gateway can be chained to give an attacker root access without logging in, provided the attacker can reach the appliance's administrative interface. Barracuda has issued patches and updated its advisory to clarify this important condition. The first flaw, CVE-2026-116606, is a pre-authentication authorisation bypass in the Email Security Gateway. The second, CVE-2026-111560, is a command-injection flaw affecting several Barracuda products. Used together against a reachable gateway admin interface, they can allow an attacker to bypass access controls and run commands with root privileges. Barracuda rates the flaws high severity, with CVSS scores of 9.3 and 8.6 respectively. Barracuda corrected its advisory on 5 November to say that authentication is not required for the first vulnerability. That does not mean every email gateway is remotely exploitable from anywhere. The attacker still needs access to its admin interface, which is why the interface's exposure and access controls matter so much. Barracuda says Email Security Gateway systems need patches BNSF-40425 for firmware 9.4.017 and newer, or BNSF-40430 for older versions. The command-injection flaw also affects its Application Delivery Controller, Message Archiver, WAF Control Centre, Web Application Firewall and Web Security Gateway, each with its own patch. Administrators should verify the exact product and firmware version rather than assuming a single update covers every appliance. The company's guidance is to restrict administrative interfaces to trusted internal networks, confirm that devices are running current firmware and ensure patches have been applied. Organisations that disabled automatic patching should install the relevant fixes manually. A device several versions behind may need more than one upgrade, Barracuda cautions. For security teams, the immediate question is whether an affected admin interface is exposed to the internet or to a broader network than intended. Restricting access reduces the attack path, but it should accompany patching, not replace it. Teams can also review access logs and configuration changes for unexpected activity, while following their normal incident-response process if compromise is suspected. Barracuda's advisory does not establish that these flaws have been exploited in the wild. The issue is nevertheless significant because an email security gateway sits on a sensitive boundary; it handles the organisation's incoming communications and may be deeply integrated with its network. The safest response is to confirm exposure and patch status promptly, then document the checks for the affected estate. This is another reminder that an appliance sold as a security product is still software that requires maintenance. The details are in Barracuda's product-specific advisory, which administrators should consult for the latest versions and remediation steps. Related reading. Follow TechBooky Follow TechBooky for more technology stories and newsroom updates. Paul Femi Balo is the founder and publisher of TechBooky. He covers artificial intelligence, African technology, digital infrastructure, enterprise technology and the global digital economy. Search TechBooky Receive top tech news directly in your inbox. Freshly squeezed. November 2026 | M | T | W | T | F | S | S | | / | 1 | | 2 | 3 | 4 | 5 | 6 | 7 | 8 | | 9 | 10 | 11 | 12 | 13 | 14 | 15 | | 16 | 17 | 18 | 19 | 20 | 21 | 22 | | 23 | 24 | 25 | 26 | 27 | 28 | 29 | | 30 | / |