Barracuda email gateways are now under attack through bugs patched last week. Confirm the fix before Friday

We flagged two Barracuda Email Security Gateway bugs on November 4, when the patch was out and no attacks were known. That changed on Monday night: Barracuda updated its advisory to say it has seen exploitation affecting “a small number of organizations.”

CISA added both bugs to its exploited list on Tuesday with a Friday, November 13 deadline, and asked agencies to look for signs of compromise, not just patch.

Barracuda’s email gateway bugs went from patched to exploited in a week. Confirm the patch actually landed, then check the config.

The 5-Minute Cyber Brief

Don’t Miss the Policy Changes That Affect Security Decisions

Get the key CISA actions, new regulations, guidance, and risk shifts in a quick daily brief.

Email addressSend me tomorrow’s brief

By subscribing you agree to our Privacy Policy.

Free. Weekday mornings. 5 minutes or less.

Barracuda now sees attacks on its email gateway bugs

CVE-2026-116606 lets someone who can reach the gateway’s admin interface restore a crafted configuration backup without logging in. CVE-2026-111560 turns a timezone value in that configuration into shell commands that run as root. Together they go from no login to root on the Email Security Gateway.

On November 5 Barracuda corrected its advisory to say no authentication is needed for the first bug, only network access to the admin interface. watchTowr published a technical analysis the same day and a detection tool. Barracuda has not shared indicators from the attacks.

• Email Security Gateway: both bugs. Patch BNSF-40425 (firmware 9.4.017 and later) or BNSF-40430 (older).
• Timezone bug only: Load Balancer ADC and WAF (BNADC-16586), Message Archiver (BNMA-32468), WAF Control Center (BNWF-60060), Web Security Gateway (BNYF-24789).
• CISA KEV: both added November 10, 2026, due November 13, forensic triage required.

Gateways whose admin page answers from the internet

An email gateway sees every message going in and out of the company. Root on it means an attacker can read and change mail, and the box sits in a trusted spot on the network.

Barracuda’s gateways have been hit hard before. In 2023 a group tracked as UNC4841 used ESG zero-days for months, and BleepingComputer reports one of them was exploited for at least seven months before it was found. Barracuda says patches usually apply automatically, so the risk sits with boxes where auto-patching was turned off.

Confirm the patch landed and check for a tampered config

• Open each appliance’s web interface and confirm the firmware is current and the patch for your product from the list above is applied. Devices several versions behind may need more than one update.
• Turn automatic patching back on anywhere it was disabled, as Barracuda recommends.
• Restrict the admin interface to internal networks or a management VPN, and remove any firewall rule that publishes it to the internet.
• If an admin page was reachable from the internet before the patch, treat the box as possibly compromised and work through the checks below.
• Ask Barracuda Support (su*****@*******da.com) for help verifying firmware or applying the patch.

Details

• CVE-2026-116606: pre-authentication authorization bypass (CWE-288), ESG before 9.4.0.030. CVSS 9.3. Requires network access to the admin UI; no credentials.
• CVE-2026-111560: OS command injection in the timezone setting (CWE-78), runs as root. ESG, ADC, BMA, WCC, WAF, WSG. CVSS 8.6.
• Advisory history: published November 2; November 5 authentication correction; November 9, 9:00 PM ET exploitation update.
• KEV: both added November 10, 2026; federal due date November 13, 2026; forensic triage required. The Canadian Centre for Cyber Security updated alert AV26-1112 on November 9.

Hunt / verify

• From outside your network, test whether each Barracuda admin page answers. Anything that loads goes first.
• In the appliance logs, look for configuration restores or backup uploads nobody on your team ran.
• Check the system timezone setting for anything other than a plain timezone name.
• Compare admin accounts, mail routing rules and global settings with your last known-good backup.

Source: Barracuda advisory (updated November 9); CISA KEV alert, November 10

Sources

• Barracuda Trust Center: Pre-Authentication Authorization Bypass and Command Injection Vulnerabilities in Certain Barracuda Products
• CISA: CISA Adds Six Known Exploited Vulnerabilities to Catalog (November 10, 2026)
• CISA Known Exploited Vulnerabilities Catalog
• BleepingComputer: Hackers now exploit critical Barracuda ESG flaws to gain root access
• The Hacker News: Experts Demonstrate Barracuda Email Security Gateway Chain Enabling Root Access Without Login
• Canadian Centre for Cyber Security: Barracuda Networks security advisory (AV26-1112)

George Bailey

George Bailey is the byline of the CyberExperts editorial desk, the team behind the CyberExperts Daily Brief. The desk covers vulnerabilities, breaches and security news from vendor advisories, CISA alerts and other primary sources, and links those sources in every story. Questions or corrections: [email protected].