Barracuda Email Gateway Flaws Exploited: Patch and Lock Down Admin Access
Attackers are now exploiting two Barracuda flaws that can be chained to take root control of an Email Security Gateway. The fix is out. The bigger question is whether anyone can reach your admin login from the internet.
Barracuda confirmed exploitation this week of CVE-2026-116606 (CVSS 9.3, Email Security Gateway only) and CVE-2026-111560 (CVSS 8.6, which also hits Load Balancer ADC, Message Archiver, WAF Control Center, Web Application Firewall and Web Security Gateway). Chained together they bypass authorisation and run commands as root. SecurityWeek reports Previdian logged 17 attempts from 15 IP addresses between 9 and 11 November, and CISA has added both to its Known Exploited Vulnerabilities catalogue.
The "Admin Access Required" Trap
Barracuda's advisory notes an attacker needs Admin UI access, and it is tempting to read that as "low risk". In our experience that is the wrong reading. Mail gateways and similar appliances are classic set-and-forget boxes. They sit outside the normal Windows patch cycle, and the admin interface often gets exposed to the internet during a rushed setup and never closed. If yours is one of those, "needs admin access" is not much of a barrier.
What To Do Now
- Patch every affected appliance. Email Security Gateway needs BNSF-40425 (9.4.017 and later) or BNSF-40430 (earlier versions). Other products have their own patches.
- Pull the admin interface off the internet. Limit it to trusted internal networks or a VPN.
- Check the version on the device. Turn automatic patching on, and apply extra updates if you are several versions behind.
- Review admin logs. Look for logins and configuration restores you do not recognise.
Recently patched Barracuda vulnerabilities exploited in attacks, SecurityWeek
Frequently Asked Questions
Which Barracuda products are affected?
CVE-2026-116606 affects the Email Security Gateway only. CVE-2026-111560 also affects Load Balancer ADC, Message Archiver, WAF Control Center, Web Application Firewall and Web Security Gateway. Each product has its own patch, so check the Barracuda advisory for your model.
Does the "needs Admin UI access" detail mean we are safe?
Not if the admin interface is reachable from the internet, or if an attacker already holds an admin login. Both are common on appliances that were set up years ago and never revisited. Restrict the admin interface to trusted internal networks as well as patching.
Does Barracuda patch these devices automatically?
Often, but not always. Automatic updates can be switched off, and a device several versions behind may need more than one update. Check the firmware version shown on the device rather than assuming it updated itself.
How do I know if the device was already compromised?
Review administrative access logs and configuration restore events for anything you did not do. Barracuda and CISA have not published indicators of compromise yet, so if you find unexplained admin activity, treat the appliance as compromised and get specialist help.
Want someone to check your gateways and appliances?
We will find what is exposed, patch the gaps and lock down admin access before it becomes an incident.
Related Guide
Cybersecurity for Sydney SMBs
Explore our complete guide to protecting your business from cyber threats.
Read the Full Guide →