Barracuda has confirmed that attackers are actively exploiting a pair of vulnerabilities in its Email Security Gateway (ESG) appliance, chaining the two flaws together to obtain full root access without ever needing valid login credentials. In an update issued the evening of November 9, 2026, the company said a small number of organizations have already been affected — a notable shift from its initial disclosure a week earlier, which had flagged the vulnerabilities as serious but had not yet reported real-world attacks.

Two Separate Bugs, One Dangerous Combination

The vulnerabilities, tracked as CVE-2026-116606 and CVE-2026-111560, each carry high severity ratings on their own, but the real danger comes from combining them. CVE-2026-116606 is a pre-authentication authorization bypass scored at 9.3 on the CVSS scale. Barracuda corrected its advisory on November 5 to clarify an important detail: attackers exploiting this flaw do not need valid credentials at all — they simply need to be able to reach the appliance’s administrative interface over the network.

CVE-2026-111560 is a command injection flaw rated 8.6. On its own, it requires an attacker to already have administrative access, which would normally limit its usefulness to insiders or attackers who’d already compromised credentials through some other means. But chained with the authorization bypass, that requirement disappears entirely — an attacker with no credentials and no prior access can use the first flaw to clear the login barrier, then use the second to inject commands and escalate to root on the device.

Because exploitation hinges on reaching the administrative interface, organizations that keep that interface off the public internet face meaningfully lower risk from this particular attack path, according to Barracuda’s own guidance. That makes network exposure of the admin panel, rather than the existence of the vulnerabilities alone, the most immediate factor determining real-world risk for any given deployment.

A Rapidly Changing Risk Picture

This is a markedly different situation than existed just a week earlier. Barracuda’s original November 2 disclosure described the flaws and made patches available, but did not report any confirmed exploitation at that point. The November 9 update changes that assessment, confirming that a small number of organizations have already been compromised — though Barracuda’s advisory does not name the affected organizations, identify the attackers responsible, or describe any specific malware deployed as part of the intrusions. That limits what defenders can currently conclude about attacker tactics beyond the vulnerability chain itself.

Both CVE-2026-116606 and CVE-2026-111560 carry a vendor-assigned severity of High. Barracuda’s advisory confirms the combined root-access outcome is possible but stops short of publishing proof-of-concept exploit requests or a detailed step-by-step attack sequence, which is a reasonable move to avoid handing a ready-made playbook to less sophisticated attackers who haven’t yet developed their own exploit.

Patch Availability Across the Product Line

The authorization bypass, CVE-2026-116606, is specific to ESG — Barracuda has not listed it as affecting other products in the portfolio. The command injection flaw, however, reaches further: beyond ESG, it also affects the Load Balancer Application Delivery Controller and Web Application Firewall product lines.

Patch availability by product:

• Email Security Gateway: patch BNSF-40425 for firmware 9.4.017 and later, or BNSF-40430 for earlier versions
• Load Balancer / Application Delivery Controller / Web Application Firewall: patch BNADC-16586
• Message Archiver: patch BNMA-32468
• WAF Control Center: patch BNWF-60060
• Web Security Gateway: patch BNYF-24789

Organizations running several versions behind the current release may need to apply multiple sequential updates rather than a single patch, so administrators should verify their current firmware baseline before assuming one update closes the gap.

Recommended Actions

• Apply the appropriate patch for each affected Barracuda product immediately, prioritizing internet-facing ESG appliances
• Restrict administrative interfaces to trusted internal networks only — this single step meaningfully reduces exposure to the unauthenticated attack chain
• Verify firmware versions across the full device fleet, since older installs may require multiple sequential updates
• Enable automatic patching where it is currently disabled
• Review logs for unexpected administrative access or configuration changes on ESG appliances, particularly since Barracuda’s advisory began on November 2

With confirmed exploitation now on the record and root-level compromise on the table, organizations running Barracuda ESG — especially with any administrative exposure to the public internet — should treat this as an active incident risk rather than a routine patch-when-convenient advisory.