On Tuesday, November 10, 2026, CISA added two Barracuda vulnerabilities to its Known Exploited Vulnerabilities catalog, based on evidence that attackers are using them. One is an authentication bypass in the Barracuda Email Security Gateway (ESG). The other is a command-injection flaw that affects the ESG and five other Barracuda products and can give an attacker root control of the appliance. Barracuda has patches. If your company filters email through a Barracuda box, or your IT provider runs one or any of the other affected Barracuda products for you, here's what to confirm this week.
What Barracuda and CISA have said
Barracuda's security advisory, first published November 2, 2026, says: "If exploited in combination, these vulnerabilities could allow an attacker to bypass authorization controls and obtain root access to the device." The first flaw, CVE-2026-116606 (CVSS 9.3), affects the Email Security Gateway. Barracuda's advisory says authentication is not required to exploit it, but the attacker must be able to reach the appliance's administrative interface. The second, CVE-2026-111560 (CVSS 8.6), is a command-injection flaw that requires administrative access and affects the ESG, Load Balancer ADC, Web Application Firewall, Web Security Gateway, Message Archiver and WAF Control Center.
On November 9, Barracuda updated the advisory to add: "We have identified exploitation activity affecting a small number of organizations." CISA added both flaws to the KEV catalog on November 10. The catalog entries give federal civilian agencies until November 13 to fix them, flag both for forensic triage (checking whether a system was already compromised before it was patched), and list known ransomware use as "Unknown."
SecurityWeek reported on November 11 that "Barracuda and CISA have not shared details on the exploitation," and that security firm Previdian observed 17 attempts targeting CVE-2026-116606 between November 9 and November 11, from 15 IP addresses in three countries. Barracuda's patch table lists a separate patch for each product, and for the ESG its documentation says to upgrade to firmware 9.4.0.029 or later.
What we are not claiming: We don't know who is exploiting these flaws, which organizations were affected, or what attackers did after getting in. Barracuda says "a small number of organizations," and the 17 attempts are one firm's count, not a total. We are not saying any particular company, industry or Brotherly client has been hit, or that this is a ransomware campaign; CISA lists ransomware use as unknown. The industries below are examples of the kinds of organizations that commonly run a mail filter or web-application appliance, not known victims.
Why this matters for manufacturers, engineering firms and nonprofits
An email security gateway sits in the path of every message your company receives: bid requests, purchase orders, drawing transmittals, donor and grant correspondence. Many shops and small offices bought one years ago, and it is the kind of box that gets installed once and forgotten. A web application firewall or load balancer can front a customer portal or ordering site in the same way. If an attacker gets root on one of these appliances, the question is not just the box itself but what it can see and what it is trusted to connect to. Barracuda's advisory is clear that the exposure is greatest when the administrative interface can be reached from outside.
What to do this week
- Find out whether you have one. Ask your IT provider, or whoever manages your email filtering and web-facing systems, whether you run a Barracuda Email Security Gateway, Load Balancer ADC, Web Application Firewall, Web Security Gateway, Message Archiver or WAF Control Center. Include hardware, virtual and test copies.
- Check the firmware and patch now. On an ESG, go to Advanced > Firmware Update, check the installed version and confirm it shows 9.4.0.029 or later, as Barracuda's documentation directs. For the other products, apply the patch Barracuda's advisory lists for that product. Appliances that are several versions behind may need more than one update, so check again after each reboot.
- Turn automatic patching back on. Barracuda recommends that anyone who disabled automatic patches set devices to receive them again.
- Take the admin interface off the internet. Barracuda recommends limiting administrative access to trusted internal networks. Ask your provider to confirm the management page cannot be reached from outside your office network or VPN.
- Look back as well as forward. CISA flagged both flaws for forensic triage. Have your provider save the appliance's logs and configuration first, and look for unexpected admin logins, restored backups, changed settings, new accounts or unfamiliar outbound connections. If something looks wrong, isolate the appliance and bring in your incident-response contact before wiping anything.
- Rotate what the box touches if you find a problem. Change admin passwords and any service, directory or API credentials the appliance holds.
- Ask about Barracuda's own guidance. If you are unsure about your firmware path, Barracuda says support can help verify versions and apply patches: support@barracuda.com.
The takeaway for IT decision-makers
Security appliances are meant to protect you, which is why attackers keep going after them and why they land on CISA's list so often. If you run any of the affected Barracuda products, patch, verify the version, take the admin interface off the internet, and check the logs for changes you didn't make. If you aren't sure what you run, make that the first question for your IT provider this week. If you would like help inventorying the security appliances and web-facing systems in your office or shop, Brotherly Technology can help.
Sources
- Barracuda: Pre-Authentication Authorization Bypass and Command Injection Vulnerabilities in Certain Barracuda Products (published Nov 2, 2026; updated Nov 5 and Nov 9, 2026; checked Nov 11, 2026)
- Barracuda Campus: Email Security Gateway remediation steps
- CISA: CISA Adds Six Known Exploited Vulnerabilities to Catalog (Nov 10, 2026)
- CISA Known Exploited Vulnerabilities Catalog (CVE-2026-116606 and CVE-2026-111560: added Nov 10, 2026, due Nov 13, forensic triage Yes, ransomware use Unknown; checked Nov 11, 2026)
- SecurityWeek: Recently Patched Barracuda Vulnerabilities Exploited in Attacks (Nov 11, 2026)