NexusSec.An email gateway sees every message coming into the company. Whoever controls it can read, redirect or tamper with your email. This post reflects what was published up to 12 November 2026.
What happened
On 2 November 2026, Barracuda published fixes for two flaws, CVE-2026-116606 and CVE-2026-111560. On 9 November it updated its advisory to say it had observed exploitation activity affecting a small number of organisations. CISA added both flaws to its Known Exploited Vulnerabilities catalogue on 10 November and gave US federal agencies until 13 November, just three days.
SecurityWeek reports that the security firm Previdian saw 17 attempts against the first flaw between 9 and 11 November, from 15 IP addresses. No one has been publicly named as responsible.
Which products are affected
| Product | Flaws | Barracuda patch |
|---|---|---|
| Email Security Gateway | Both | BNSF-40425 (firmware 9.4.017 and later) or BNSF-40430 (older firmware) |
| Load Balancer ADC | CVE-2026-111560 | BNADC-16586 |
| Web Application Firewall | CVE-2026-111560 | BNADC-16586 |
| WAF Control Center | CVE-2026-111560 | BNWF-60060 |
| Web Security Gateway | CVE-2026-111560 | BNYF-24789 |
| Message Archiver | CVE-2026-111560 | BNMA-32468 |
CVE-2026-116606 is an authorization bypass with a CVSS score of 9.3. It needs no login, only access to the gateway's administrative interface. CVE-2026-111560 is a command injection, scored 8.6, that needs administrative access. Chained, Barracuda says, they could let an attacker bypass authorization and obtain root access to the device. Barracuda's advisory does not mention its cloud services.
Why an automatic patch still needs checking
Barracuda delivers many fixes automatically, but its advisory says that if a patch has not been applied automatically, customers should apply it by hand as soon as possible. It also asks customers who switched automatic patching off to turn it back on. So do not assume: check each appliance, including standby units in a pair and any at branch sites.
What to do
Today
- List every Barracuda appliance you run, including standby units and ones at branch sites.
- Confirm the right patch is installed on each one, using the table above. If it will not apply, or the firmware is several versions behind, contact Barracuda support.
- Take admin interfaces off the internet. Barracuda's own workaround is to restrict them to trusted internal networks. Do that at your firewall now, whatever the patch status. Our guide to finding your internet exposure shows how to check what is reachable.
- Turn automatic patching back on if it was switched off.
If the admin interface was reachable from the internet
Treat the appliance as possibly compromised until you have checked. With root access, an attacker who got in before the patch can still be there after it.
- Keep the evidence: the appliance's audit logs, your firewall logs and a copy of the current configuration, before anything rolls over.
- Compare the configuration with a known-good backup, looking for mail forwarding rules, new accounts and changes nobody can explain.
- Bring in help if anything looks wrong. Contact Barracuda support, follow your incident response plan, and remember that under CERT-In's directions a compromise like this must be reported within six hours of noticing it.
There is a reason to be thorough. In 2023, after a different Email Security Gateway flaw (CVE-2023-2868), Barracuda told customers to replace compromised appliances rather than only patch them. It has not said that this time, but it shows that a compromised gateway needs proper checking, not just an update.
Sources
- Barracuda: Pre-authentication authorization bypass and command injection vulnerabilities in certain Barracuda products, published 2 November 2026, updated 9 November 2026
- SecurityWeek: Recently patched Barracuda vulnerabilities exploited in attacks, 11 November 2026
- Suped: CISA lists two actively exploited Barracuda email gateway flaws, 10 November 2026
