Urgent awareness alert. This is awareness content, not a monitored threat intelligence service: always check vendor advisories against your own environment.
On 10 November 2026 CISA added two Barracuda Email Security Gateway (ESG) flaws to its Known Exploited Vulnerabilities catalogue, based on evidence of active exploitation, and Barracuda says attackers have used them against a small number of organisations. CVE-2026-116606 (CVSS 9.3) is an authorisation bypass: an unauthenticated attacker who can reach the appliance’s administrative interface can import a crafted configuration backup and change its settings. Chained with CVE-2026-111560 (CVSS 8.6), a command injection flaw, it can give the attacker root access to the gateway. All ESG appliances on firmware earlier than 9.4.0.030 are affected. Because an email gateway sits in front of your mail and handles every message, any organisation running a Barracuda ESG appliance should treat this as urgent.
What to do:
- Update every ESG appliance to the latest firmware (9.4.0.030 or later) and confirm the security patches Barracuda lists in its advisory are applied.
- Check for compromise: review the configuration change history and logs for unexpected backup imports, new administrator accounts, or changed mail routing, and follow Barracuda’s guidance if you find anything.
- Restrict exposure: make sure the administrative interface cannot be reached from the internet, and limit it to trusted management addresses.
Source: Barracuda security advisory
If you would like help assessing your exposure, contact us.
