Barracuda Confirms Active Exploitation of Email Gateway Flaws Allowing Unauthenticated Root Access

Barracuda has confirmed active exploitation of security flaws affecting its Email Security Gateway (ESG), warning that attackers could combine two vulnerabilities to gain root access without logging in.

In a November 9, 2026, update issued at 9:00 p.m. EST, the company said exploitation had affected a small number of organizations.

The flaws, tracked as CVE-2026-116606 and CVE-2026-111560, involve an authorization bypass and command injection. Successful exploitation requires access to the appliance’s administrative interface.

This condition makes exposed management pages a key concern, although Barracuda says organizations with interfaces kept off the public internet are less exposed to this attack path.

The confirmation changes the risk picture from the initial November 2 disclosure. Cybersecurity News previously covered the Barracuda security flaws and available patches before the vendor reported active attacks.

Barracuda’s latest advisory does not identify the attackers, affected organizations, malware, or the exact number of victims.

Barracuda email gateway flaws

CVE-2026-116606 is a pre-authentication authorization bypass affecting ESG, with a CVSS score of 9.3. On November 5, Barracuda corrected its advisory to clarify that attackers do not need valid credentials.

They must, however, be able to reach the administrative user interface. Network access and authenticated access are therefore separate requirements.

CVE-2026-111560 is a command injection flaw with a CVSS score of 8.6. On its own, it requires administrative access. Combining it with the authorization bypass could remove that login barrier and provide root access to the device.

ESG is the only listed product affected by both vulnerabilities, so the unauthenticated chain should not be assumed to affect every listed product.

According to Barracuda’s updated security advisory, both flaws carry a vendor severity rating of High. Its public guidance confirms the combined root-access risk but does not provide exploit requests or a detailed attack sequence.

This limits what defenders can conclude about the methods used in the observed incidents.

ESG customers need patch BNSF-40425 for versions 9.4.017 and later, or BNSF-40430 for earlier versions. The command injection flaw also affects Load Balancer Application Delivery Controller and Web Application Firewall, patched through BNADC-16586.

Message Archiver requires BNMA-32468, WAF Control Center requires BNWF-60060, and Web Security Gateway requires BNYF-24789.

These products serve different roles, making accurate device inventories important when checking patch coverage.

For readers reviewing how mail-filtering appliances fit into their defenses, Cybersecurity News’ email security gateway guide explains their role in screening messages and attachments. That protective role makes gateway security an important part of email defense.

Barracuda recommends restricting administrative interfaces to trusted internal networks and applying appropriate network access controls. Customers should verify the latest firmware and every applicable security patch are installed.

Devices several versions behind may need multiple updates. Missing patches should be installed manually, and automatic patching enabled where disabled.

Barracuda Campus provides product-specific instructions, while Barracuda Support can help confirm update status.

The post Barracuda Confirms Active Exploitation of Email Gateway Flaws Allowing Unauthenticated Root Access appeared first on Cyber Security News.