Barracuda Email Security Gateway: exploited flaw CVE-2026-116606 gives attackers root access

Barracuda confirmed that attackers are exploiting two flaws in its Email Security Gateway. CISA added them to its Known Exploited Vulnerabilities catalog on 10 November. The fix is in version 9.4.0.030.

Barracuda Email Security Gateway (ESG), the appliance and service that filters company email, has a chain of two flaws that, according to published reports, lets an unauthenticated attacker gain root access. Cybersecurity News and The Hacker News report that Barracuda confirmed on 9 November 2026 that the flaws are being exploited against a small number of organizations. CISA added both vulnerabilities to its Known Exploited Vulnerabilities catalog on 10 November.

The first flaw, CVE-2026-116606, is an authentication bypass (CWE-288, CVSS 9.3). An attacker without a login can restore a crafted backup on the gateway. The second, CVE-2026-111560, is a command injection in the timezone field that runs as root and, according to reports, affects six Barracuda products, not only ESG. Together they form a path from the internet to full control of the gateway through which all company email passes.

Which version should you install? Most sources say ESG 9.4.0.030 and later contains the fix. One source mentions build 9.4.0.029, but the CVE record speaks of versions earlier than 9.4.0.030, so treat 9.4.0.030 as the safe target. For the other affected Barracuda products the reports so far list only patch IDs, not firmware versions, so read the vendor advisory directly.

What if the gateway runs in your network? Check the firmware version and install the fix. If the appliance was reachable from the internet, do not rely on the update alone: look for unknown backups, accounts or scheduled tasks, and consider rotating the keys and passwords the gateway uses. A patch does not clean a device that an attacker has already rooted.