Barracuda Email Gateways Under Attack: Hackers Chain Two Flaws to Take Full Control

Barracuda has confirmed that attackers are now exploiting two flaws in its Email Security Gateway appliances. Used together, the two bugs let an attacker with no login at all take full control of the gateway as root. CISA, the US Cybersecurity and Infrastructure Security Agency, added both flaws to its Known Exploited Vulnerabilities catalog on November 10, 2026, and gave federal civilian agencies until November 13 to fix them, an unusually short three-day window.

Email gateways sit in the path of every message a company sends and receives, and an attacker who controls one can read mail and copy credentials. The patches have been available since November 2, so the urgent question is simple: are you patched, and was your admin interface ever exposed?

What Happened

Barracuda released fixes for the two flaws on November 2, 2026. At that point there was no known exploitation, no CISA listing, and no public exploit code, only a detection tool that checks whether an appliance is vulnerable.

That changed with an advisory update Barracuda posted on the evening of November 9, US time. The update said the flaw chain has been exploited against a small number of organizations. CISA followed within hours by adding both flaws to its catalog. Barracuda has not disclosed how many organizations were hit, what the attackers did, or any indicators of compromise. No threat actor has been publicly linked to the activity.

How the Two Flaws Work Together

The first flaw, tracked as CVE-2026-116606, is an authorization bypass in the Email Security Gateway, rated 9.3 under the CVSS version 4 scoring system. Barracuda clarified on November 5 that the flaw needs no authentication, but the attacker must reach the appliance's administrative interface. Lock it away on a trusted management network and it cannot be reached from outside. Expose it to the internet and anyone can knock on the door.

The second flaw, tracked as CVE-2026-111560, is an operating system command injection tied to the timezone setting, rated 8.6. On its own it requires administrative access, which limits its danger. Combined with the authorization bypass, that requirement disappears. The bypass hands the attacker the admin-level access the injection needs, and the injection then runs commands as root, the highest privilege on the device.

Together, the two flaws let an unauthenticated attacker who can reach the admin interface take full control of the gateway. That is the whole chain: no stolen password, no phishing email, no insider help. The only precondition is a reachable admin page.

Who Is Affected

The Email Security Gateway is the only product exposed to the full no-login-to-root chain. Barracuda's email security appliances are widely deployed at small and mid-sized businesses, schools, and local government offices.

The command injection flaw on its own also affects five other Barracuda product lines: Load Balancer ADC, Message Archiver, WAF Control Center, Web Application Firewall, and Web Security Gateway. On those products an attacker needs admin access first, so the risk is lower, though weak, reused, or stolen admin credentials still open the door.

Barracuda's advisory lists the Email Security Gateway fixes as BNSF-40425 for firmware 9.4.017 and later, and BNSF-40430 for older firmware. Some reports cite a fixed firmware number instead, so check the patch level against Barracuda's own advisory table. The other five product lines have their own patches, listed in the same advisory.

A Familiar Pattern With an Uncomfortable History

This is not the first time Barracuda's email gateway has been attacked. In 2023, a state-backed group exploited a different zero-day flaw in the same product line so deeply that the vendor told customers to replace affected appliances rather than patch them. No link between that campaign and the current activity has been established.

What to Do Now

If your organization runs Barracuda gear, the work is straightforward and it should not wait for the next patch cycle.

1. Verify the patch, do not assume it. Confirm the correct fix is installed on every Email Security Gateway, including standby nodes and remote sites, and check the firmware against Barracuda's advisory table.

2. Lock down the admin interface. It should only be reachable from a trusted management network, so review firewall rules and remote-access exceptions that may expose it. This single step removes the precondition the whole attack chain depends on.

3. Patch the other product lines. Apply the CVE-2026-111560 fixes on Load Balancer ADC, Message Archiver, WAF Control Center, Web Application Firewall, and Web Security Gateway, and rotate admin passwords on those devices.

4. Check for compromise, not just for the patch. If the admin interface was ever exposed, or you see unexplained changes, new admin accounts, or unusual outbound connections, preserve logs and start incident response. CISA's entries for both flaws call for forensic triage, not just patching.

5. Check mail flow and rules after recovery. Look for unexpected forwarding, journaling, or relay settings that could silently copy mail. An attacker with root can set these up in seconds.

Why the Three-Day Deadline Matters

CISA's Known Exploited Vulnerabilities catalog is a to-do list for federal agencies, and its deadlines are usually measured in weeks. A three-day deadline signals active, ongoing exploitation. Private companies are not bound by it, but the risk is the same for them.

Organizations that marked these flaws as patch in the next cycle should move them to the top of the queue now. Patching after a compromise does not remove an attacker who is already on the box. The patch closes the door. It does not evict anyone who already walked through it.

Frequently Asked Questions

Am I affected if my company uses Barracuda email security?

If your organization runs a Barracuda Email Security Gateway, yes, check it now. The full attack chain affects that product only, and it needs the admin interface to be reachable. If you use Barracuda's cloud email service, ask your provider whether the flaws apply to you.

Is installing the patch enough to be safe?

The patch stops new attacks, but it does not remove an attacker who already got in. If your gateway's admin interface was exposed, or you notice odd changes or new admin accounts, treat the device as possibly compromised and run a forensic check. Preserve logs before you wipe or rebuild anything.

What should I do if I cannot patch by November 13?

Restrict access to the admin interface immediately so only a trusted management network can reach it. Then apply the patch as soon as you can, and check the device for signs of compromise.