Barracuda Email Security Gateway: Update Firmware and Lock Down the Admin Page

If your business filters email through a Barracuda Email Security Gateway (ESG), or uses another Barracuda appliance such as a Web Application Firewall, Web Security Gateway, Load Balancer or Message Archiver, it is worth checking it this week. On November 10, 2026, CISA added two Barracuda flaws, CVE-2026-116606 and CVE-2026-111560, to its Known Exploited Vulnerabilities catalog.

The short version: make sure every Barracuda appliance is on the latest firmware with all security patches applied, and make sure its administrative web page cannot be reached from the internet.

What the flaws do

Barracuda's advisory, published November 2, describes two problems. CVE-2026-116606 lets someone who can reach an Email Security Gateway's admin page get past the login and restore a crafted backup, changing the appliance's settings. Barracuda updated the advisory on November 5 to make clear that no password is needed, only access to the admin page. CVE-2026-111560 lets an administrator-level user run operating-system commands as root through the timezone setting. Barracuda says that used together, they can give an attacker root access to the device, and that it has seen exploitation affecting a small number of organizations.

Barracuda rates the first flaw 9.3 and the second 8.6 on the CVSS severity scale. CISA set a short federal remediation due date of November 13, 2026, and asks agencies to check for signs of compromise as well as patch.

Who is at risk

• Email Security Gateway: affected by both flaws, so it is the most urgent to update.
• Load Balancer ADC, Message Archiver, WAF Control Center, Web Application Firewall and Web Security Gateway: affected by the command-injection flaw. Barracuda recommends patching these too.

Barracuda notes that appliances whose admin pages are reachable only from trusted internal networks are less exposed.

What to do this week

1. Find your Barracuda appliances. Check email filtering, web filtering, firewalls and archiving, including boxes your IT provider manages for you.
2. Update to the latest firmware. For the Email Security Gateway, Barracuda's instructions say to confirm the appliance reports firmware 9.4.0.029 or later under Advanced > Firmware Update, and that older appliances may need more than one update to get there. Some government advisories list versions before 9.4.0.030 as affected, so install the newest version your appliance offers.
3. Turn on automatic patching if it was switched off, as Barracuda recommends.
4. Restrict the admin page to your internal network or a VPN, never the open internet.
5. Look for signs of misuse. Review the appliance's settings and admin accounts for changes nobody made, and change admin passwords if anything looks off. Barracuda Support can help verify firmware and patches.

Questions to ask your IT provider

1. Do we have any Barracuda appliances, and are they all on the latest firmware with patches applied?
2. Can any of their admin pages be reached from the internet?
3. Have the settings and admin accounts been checked for changes since early November?