Barracuda Networks has confirmed that vulnerabilities in its Email Security Gateway (ESG) are currently being exploited by attackers. These security flaws, identified as CVE-2026-116606 and CVE-2026-111560, can be combined to gain unauthorized root access without the need for login credentials. The company issued an update on November 9, 2026, highlighting that a limited number of organizations have been impacted.
Understanding the Vulnerabilities
The two security issues involve serious weaknesses: an authorization bypass and a command injection vulnerability. Attackers can leverage these flaws to penetrate the administrative interface of the ESG. Consequently, organizations that expose these management pages to the internet are at higher risk. However, those who restrict access to internal networks are less vulnerable.
Impact and Response
The November 9 update alters the understanding of risks since the initial announcement on November 2, where patches were recommended. Barracuda has not disclosed specific details about the attackers or the exact number of compromised entities. The vulnerabilities have received high severity ratings, with CVSS scores of 9.3 and 8.6, respectively, emphasizing the need for immediate attention.
Protective Measures and Recommendations
Barracuda advises organizations to limit access to the administrative interfaces and ensure all security patches are up-to-date. For instance, ESG users should apply patch BNSF-40425 for the latest versions or BNSF-40430 for older versions. Other affected products include Load Balancer Application Delivery Controller and Web Application Firewall, which require separate patches.
Furthermore, users are encouraged to maintain updated device inventories and apply network access controls to minimize exposure. Devices that are not current with updates should have their patches installed manually, and automatic patching should be enabled to prevent future vulnerabilities.
Conclusion and Future Outlook
This confirmation of active exploitation underscores the critical importance of maintaining robust cybersecurity measures. Organizations using Barracuda’s products should remain vigilant and ensure that security patches are applied promptly to safeguard against potential breaches. The evolving threat landscape necessitates continuous monitoring and adaptation to protect sensitive data effectively.
