Barracuda Email Security Gateway appliances taken over through the admin interface (CVE-2026-116606)

11 November 2026Critical 9.3Being exploited

Barracuda Networks · Barracuda Email Security Gateway (ESG) and other Barracuda appliances · CVE-2026-116606

Barracuda Email Security Gateway appliances taken over through the admin interface

Two flaws can be chained to take over a Barracuda Email Security Gateway. CVE-2026-116606 lets someone who can reach the admin interface change the appliance's configuration without logging in, and CVE-2026-111560 (CVSS 8.6) then lets them run commands as root. Barracuda said on 9 November that it has seen exploitation affecting a small number of organisations, and CISA added both flaws to its Known Exploited Vulnerabilities catalogue on 10 November.

Affected: Barracuda Email Security Gateway is affected by both flaws (NVD lists versions earlier than 9.4.0.030 for CVE-2026-116606). CVE-2026-111560 on its own, which needs an administrator login, also affects Load Balancer ADC, Message Archiver, WAF Control Center, Web Application Firewall and Web Security Gateway. An attacker needs to be able to reach the admin interface, so appliances with it open to the internet are most at risk.
What to do: Check that the security patch has been applied: for ESG, BNSF-40425 (firmware 9.4.017 and later) or BNSF-40430 (earlier firmware); BNADC-16586 for Load Balancer ADC and Web Application Firewall, BNMA-32468 for Message Archiver, BNWF-60060 for WAF Control Center and BNYF-24789 for Web Security Gateway. Patches may arrive automatically; if not, apply them by hand, bring firmware up to the latest version and turn automatic patching on. Restrict the admin interface to trusted internal networks. Barracuda's advisory gives no indicators of compromise, so contact Barracuda Support if the interface was exposed.General information summarised from the vendor's advisory at the time of writing, not professional advice. Check the vendor's current advisory before acting.
Why it’s here: Confirmed exploited and on CISA's catalogue, in an email filtering appliance many businesses and their IT providers run.

Barracuda Email Security Gateway appliances taken over through the admin interface

Affected

Barracuda Email Security Gateway is affected by both flaws (NVD lists versions earlier than 9.4.0.030 for CVE-2026-116606). CVE-2026-111560 on its own, which needs an administrator login, also affects Load Balancer ADC, Message Archiver, WAF Control Center, Web Application Firewall and Web Security Gateway. An attacker needs to be able to reach the admin interface, so appliances with it open to the internet are most at risk.

What to do

Check that the security patch has been applied: for ESG, BNSF-40425 (firmware 9.4.017 and later) or BNSF-40430 (earlier firmware); BNADC-16586 for Load Balancer ADC and Web Application Firewall, BNMA-32468 for Message Archiver, BNWF-60060 for WAF Control Center and BNYF-24789 for Web Security Gateway. Patches may arrive automatically; if not, apply them by hand, bring firmware up to the latest version and turn automatic patching on. Restrict the admin interface to trusted internal networks. Barracuda's advisory gives no indicators of compromise, so contact Barracuda Support if the interface was exposed.General information summarised from the vendor's advisory at the time of writing, not professional advice. Check the vendor's current advisory before acting.

Why it’s here

Confirmed exploited and on CISA's catalogue, in an email filtering appliance many businesses and their IT providers run.