Running a Barracuda Email Security Gateway? Check your firmware today.

What was announced

Barracuda published a security advisory on November 2, 2026 covering two vulnerabilities in the Email Security Gateway (ESG), the appliance many offices and IT providers use to filter mail before it reaches the mail server.

• CVE-2026-116606 lets someone who can reach the appliance's administration page get past the login without a password.
• CVE-2026-111560 lets them run their own commands on the appliance once they are in.

On November 5, Barracuda clarified that the first flaw needs access to the administration page but no login. On November 9, it added that it has seen exploitation affecting a small number of organizations. On November 10, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added both flaws to its list of vulnerabilities known to be exploited.

Who this affects

Any organization with a Barracuda Email Security Gateway appliance, physical or virtual, in its own office, data center or cloud account. The second flaw (CVE-2026-111560) also affects other Barracuda appliances: Web Application Firewall, WAF Control Center, Load Balancer ADC, Message Archiver and Web Security Gateway. If you have any of those, they need the same check.

If you are not sure whether you have one, ask whoever manages your email. A mail gateway is easy to forget because it works quietly for years.

What to do

1. Confirm the firmware and security patches are current. Sign in to the appliance and check the firmware version and the installed security patches. Barracuda's fixes for the ESG are patch BNSF-40425 (firmware 9.4.017 and later) and BNSF-40430 (older firmware). Barracuda also advises moving to the latest firmware.
2. Do not assume it updated itself. Barracuda delivers these patches automatically, but only where automatic patching is turned on and the appliance can reach Barracuda. If the patch is not there, apply it by hand, and turn automatic patching back on.
3. Take the administration page off the internet. The attack needs to reach that page. Barracuda recommends limiting it to trusted internal networks. Reach it over a VPN or from the office only.
4. If the appliance was unpatched with its administration page exposed, look closer. Review administrator accounts, configuration changes and mail rules for anything you did not set up, change the appliance passwords, and contact Barracuda support or your IT provider if something looks wrong.
5. If someone else manages it, ask them two questions: which patch is installed, and can the administration page be reached from the internet? Both have short answers.

A habit worth keeping

This is not a reason to distrust mail gateways. Every product that sits at the edge of a network has months like this one. The lesson is about upkeep: know what firmware each appliance runs, make sure updates really arrive, and keep administration pages off the public internet. Those three habits apply to any vendor's equipment, ours included.

Where EFA fits

• OpenEFA is available both ways. You can use it as a hosted service, where we run, patch and monitor the filtering for you, or as an OpenEFA appliance that runs on your own premises when mail has to stay in house. The filtering is the same either way, and we are glad to help you decide which fits.
• Want a second look? Ask us and we will help you check a gateway's firmware and exposure, whichever brand it is.
• Stay informed. Sign up for alerts to get advisories like this one by email.

Sources: Barracuda Networks security advisory, published November 2, 2026 and updated November 5 and November 9, 2026; CISA Known Exploited Vulnerabilities catalog, November 10, 2026; Beazley Security Labs advisory BSL-A1240. Summary by the EFA Security team, November 11, 2026. Barracuda's advisory is the authority on versions and patches; check it for changes.