Barracuda Confirms Active Exploitation of Appliance Flaws

Barracuda Confirms Exploitation of Two Appliance Vulnerabilities

Barracuda Networks, a vendor of email, network, and web application security appliances, confirmed on November 9, 2026, that attackers have exploited two vulnerabilities affecting a small number of organizations running its appliance products. According to Barracuda's security advisory, the two flaws, tracked as CVE-2026-116606 and CVE-2026-111560, can be chained together to bypass authorization controls and obtain root access to an affected device. Barracuda first published the advisory on November 2, 2026, and has updated it twice since, most recently to disclose the exploitation activity. The company has not said how the affected organizations were identified, how many devices were compromised, or which industries or regions were involved.

Barracuda also revised the advisory on November 5, 2026, to correct a detail about CVE-2026-116606: the company now states that exploitation does not require stolen login credentials, but it does require that an attacker can reach the device's administrative user interface, referred to in the advisory as the Admin UI. That distinction matters for anyone assessing their own exposure, since it shifts the key risk factor from credential theft to network exposure.

What Each Vulnerability Does

CVE-2026-116606 is a pre-authentication authorization bypass affecting Barracuda's Email Security Gateway (ESG). Barracuda rates it High severity with a CVSS score of 9.3 out of 10 under the Common Vulnerability Scoring System, the industry standard used to rank how easily and severely a flaw can be exploited. An attacker who can reach the ESG Admin UI does not need valid credentials to abuse this bug.

CVE-2026-111560 is a command injection vulnerability, also rated High severity with a CVSS score of 8.6, but it requires the attacker to already have administrative access. It affects a wider set of products than the first flaw: Email Security Gateway (ESG), Load Balancer Application Delivery Controller (ADC), Message Archiver (BMA), WAF Control Center (WCC), Web Application Firewall (WAF), and Web Security Gateway (WSG). Barracuda's advisory states that when the two bugs are used together, an attacker can bypass authorization controls and escalate to root access on the device, the highest level of system control.

Barracuda has released firmware patches for every affected product line: BNSF-40425 (version 9.4.017 and later) or BNSF-40430 (versions before 9.4.017) for ESG, BNADC-16586 for ADC and WAF, BNMA-32468 for BMA, BNWF-60060 for WCC, and BNYF-24789 for WSG.

Analysis: Why This Matters Even Without Attribution

Barracuda's advisory does not identify which organizations or sectors were affected by the confirmed exploitation, and Bellator Cyber Guard has no independent information on that point. What can be assessed is exposure: this vulnerability chain is relevant to any organization running Barracuda ESG, ADC, BMA, WCC, WAF, or WSG appliances, regardless of industry.

In our assessment, the operational stakes are highest for organizations that route sensitive communications or stored records through these devices, since an Email Security Gateway, Message Archiver, or Web Application Firewall typically sits in the path of business email, client files, or web traffic. Healthcare practices, tax and accounting firms, and other small businesses that rely on these appliances for email filtering or traffic inspection should treat this advisory as a prompt to verify their own patch status and network exposure, not because Barracuda has named these sectors as victims, but because a compromise of a device handling that kind of data could carry real operational and regulatory consequences depending on the records involved. Organizations with existing breach-notification or incident-response obligations, whether contractual, state, or federal, should factor confirmed in-the-wild exploitation of these CVEs into their own risk assessments, separate from Barracuda's advisory itself.

Automatic patching matters for any organization that has disabled it, not just smaller ones: a device left on manual updates can sit multiple firmware versions behind indefinitely if nobody tracks it, which is precisely the scenario Barracuda's advisory addresses when it warns that severely outdated devices may need more than one sequential update.

Immediate Steps to Take

Organizations running any of the affected products, ESG, ADC, BMA, WCC, WAF, or WSG, should take three steps now. First, confirm the device is running the latest firmware and has received the applicable patch (BNSF-40425/BNSF-40430, BNADC-16586, BNMA-32468, BNWF-60060, or BNYF-24789, depending on the product). The device interface itself will display the latest available firmware version. Second, verify that automatic patching is enabled; Barracuda recommends this as the default going forward rather than relying on manual updates. Barracuda's advisory also notes that a device several firmware versions out of date may need more than one sequential update to reach the current, patched version, so organizations that have deferred updates for an extended period should expect to apply multiple patches rather than a single upgrade. Third, and most important given the attack path Barracuda describes, restrict administrative interface access to trusted internal networks only, removing any direct internet exposure of the Admin UI and placing it behind a VPN or other access control layer.

Organizations that cannot verify their firmware version or patch status on their own can contact Barracuda Support at support@barracuda.com, as recommended in the company's advisory. Because Barracuda has already confirmed exploitation in the wild affecting some customers, even organizations that believe they are current on patches should verify their status now rather than assume it.