The Patch Was Ready. The Attacks Came Anyway.

The patch was ready. The attacks came anyway. Barracuda Networks warned on Monday evening that attackers have begun exploiting two recently patched Email Security Gateway vulnerabilities — the same two flaws this blog covered last week — to gain root access on customer systems.

Barracuda released the security updates one week ago. On Monday, the company updated its advisory with the news every administrator dreads: “We have identified exploitation activity affecting a small number of organizations.” The flaws, tracked as CVE-2026-116606 and CVE-2026-111560, are being exploited in attacks right now.

Two flaws, one root shell

The attack chains the two flaws together. The first, CVE-2026-116606, is an authentication weakness in the Email Security Gateway that lets an attacker modify the appliance’s global configuration. The second, CVE-2026-111560, lets an unauthenticated attacker inject operating system commands that execute with root privileges. Used together, they bypass the authorization controls entirely and hand the attacker the keys to the device.

There is one important condition: the attacks require access to the administrative user interface of the targeted device. Barracuda says that if the Admin UI is not reachable, the attack does not work — which is why the company’s first piece of advice is to restrict the Admin UI to trusted internal networks and use network access controls to limit who can reach it.

The patches cover more than the email gateway. CVE-2026-111560 also affects Barracuda’s Load Balancer ADC, Message Archiver, WAF Control Center, Web Application Firewall, and Web Security Gateway products, each with its own patch: BNSF-40425 or BNSF-40430 for the Email Security Gateway, BNADC-16586 for the load balancer and firewall, BNMA-32468 for the archiver, BNWF-60060 for the WAF Control Center, and BNYF-24789 for the Web Security Gateway.

What Barracuda is telling customers

“Barracuda immediately initiated a comprehensive remediation process and released security patches for affected products,” the company said. Its guidance is blunt: if a patch has not been applied automatically, apply it manually as soon as possible. And if automatic patching has been turned off, turn it back on.

That last point is worth pausing on. The patches have existed for a week. The exploitation started anyway, which means some customers had not applied them — or had disabled the automatic updates that would have applied them. A patch that sits uninstalled protects no one.

This has happened before

Barracuda’s email gateways have been a target before, and the history is a warning. In 2023, the UNC4841 hacking group exploited two Barracuda ESG zero-days — CVE-2023-7102 and CVE-2023-2868 — in a cyber-espionage campaign. The flaws had been exploited as zero-days for at least seven months, since October 2022, to drop previously unknown SeaSpy and Saltwater malware and steal data. According to Mandiant, almost a third of the systems breached in that campaign belonged to government agencies.

The parallel is uncomfortable: a gateway that sits at the edge of the network, processing every email, makes a high-value target. Once an attacker has root on it, they can read mail, redirect traffic, and pivot deeper into the network. The same lesson applied to the SonicWall firewall flaw last week — security appliances are only as safe as their patch level, and attackers watch for the gap between a patch release and its installation.

What to do now

Apply the patch today. Check whether the update has been applied automatically; if not, apply it manually. The Email Security Gateway needs BNSF-40425 (version 9.4.017 and later) or BNSF-40430 (earlier versions). Check the other affected products against the patch list above.

Turn automatic patching back on. If it was disabled, re-enable it. Barracuda’s own recommendation is explicit, and this week’s exploitation is the reason why.

Pull the Admin UI off the internet. Restrict access to trusted internal networks and put it behind a VPN. An administrative interface that anyone on the internet can reach is an invitation, not a configuration.

Review recent logins and configuration changes. If your gateway was reachable and unpatched during the last week, check the Admin UI access logs for unfamiliar sessions and review the global configuration for changes you did not make. Any sign of tampering means the device should be treated as compromised until proven otherwise.

Barracuda has more than 200,000 customers worldwide, from small businesses to large enterprises and managed service providers. The exploitation is limited to a small number of organizations so far — but the window between patch and attack was seven days. If you run one of these gateways, that window is the only warning you get.