Barracuda Email Gateway Exploited: Patch, Then Pen Test It

• Ruben Selby
• November 11, 2026
• No Comments

On 7 November we told you to patch your Barracuda Email Security Gateway. Since then, Barracuda has confirmed that attackers are using the flaws against real organisations. If you run one of these boxes, or your IT provider installed one years ago, patching is the start of the job, not the end.

What happened to the Barracuda Email Security Gateway

Barracuda disclosed two flaws on 2 November: CVE-2026-116606, an authorisation bypass rated 9.3, and CVE-2026-111560, a command injection rated 8.6. Barracuda’s advisory says that together they could let an attacker bypass authorisation controls and get root access to the device. Late on 9 November it added that it had “identified exploitation activity affecting a small number of organizations”.

The Register reports that Barracuda would not say how many were hit, and that who is responsible is not yet known. Barracuda’s advisory says the attacker needs access to the administrative interface. Daily CyberSecurity reports that CISA added both flaws to its Known Exploited Vulnerabilities catalogue on 10 November and that exploit code has been published. We have not been able to open CISA’s own alert, so treat that as their report.

Why it matters if you run a small or mid-sized business

The mechanism is simple. The attacker does not need a password for the first flaw. They need to be able to reach the gateway’s admin page. The second flaw then runs commands as root. Neither step needs a user to click anything.

So the control that matters most is not the patch. It is whether the admin page can be reached from the internet at all. Barracuda itself says organisations whose admin interfaces are not publicly accessible are less exposed. A patch closes this hole. It does not tell you why the admin page was open in the first place, and it does not tell you what else is.

Here is the kind of thing a perimeter test turns up. Appliances installed by a supplier years ago and never revisited. Management pages left open “temporarily” for a support call. Firewall exceptions nobody remembers. A second Barracuda product on the same network: the command injection flaw also affects the Load Balancer ADC, Message Archiver, WAF Control Center, Web Application Firewall and Web Security Gateway, according to Barracuda’s table. A scanner reports a version number. A tester asks what an attacker could do from here, and follows the answer.

There is a harder question too. Patching stops new attacks. It does not remove someone who got in before the patch. Barracuda has not said what the affected organisations lost. If your admin page was ever reachable from the internet, check rather than hope.

What to do this week

1. Ask your IT provider whether you own any Barracuda appliance, including old ones and ones a supplier manages, and get a written list.
2. Have them confirm each Email Security Gateway has the right patch from Barracuda’s table (BNSF-40425 for firmware 9.4.017 and later, BNSF-40430 for earlier), and that automatic patching has not been switched off.
3. Make sure every admin interface is reachable only from your trusted internal network, and ask them to prove it from outside, not just read the firewall rules.
4. If an appliance was reachable from the internet before patching, ask for a review of its configuration and logs for unexpected changes, and escalate to Barracuda Support if anything looks wrong.
5. Commission an external test of your perimeter so someone looks for every management page and forgotten device, not just the one in the news.

How Wolfcore helps

A penetration test from Wolfcore simulates what an attacker would do against your internet-facing systems. We look for the open admin pages, the forgotten appliances and the gaps between what your records say and what is actually reachable. You get a plain-English report your IT person can act on. To talk it through, get in touch.

Sources

• Barracuda: Pre-Authentication Authorization Bypass and Command Injection Vulnerabilities in Certain Barracuda Products (updated 9 November 2026)
• The Register: Barracuda’s email security gateways bitten by make-me-root vulns (10 November 2026)
• BleepingComputer: Hackers now exploit critical Barracuda ESG flaws to gain root access (10 November 2026)
• Daily CyberSecurity: CISA Adds Six Exploited Flaws to KEV Catalog (11 November 2026)

Related reading: Zyxel GS1900 patch failed? Check your office switches

Ruben Selby, Founder and Lead Security Consultant, Wolfcore