Critical Barracuda email gateway flaw: patch now

A critical Barracuda Email Security Gateway flaw can give attackers root without a login. No exploitation confirmed yet, so patch now.

There is one device on your network that reads every email before you do. Every quote, every contract, every invoice with a bank account number, every password reset. It's called the mail gateway, and if yours is a Barracuda Email Security Gateway (ESG), it picked up a critical flaw this week. The Centre for Cybersecurity Belgium (CCB) urges organisations to patch immediately.

Let's be clear from the start: there is no confirmed exploitation right now, and at the time of writing (5 Nov) the flaw is not on the US CISA KEV list of actively exploited vulnerabilities. That's the good news. You still have a head start. The question is for how long.

What's going on

On 2 November, Barracuda published an advisory covering two vulnerabilities. The first, CVE-2026-116606, lets an attacker bypass the admin interface's protection without logging in and change the appliance's entire configuration. Its CVSS score, the standard severity scale, is 9.3 out of 10. The second, CVE-2026-111560 (8.6), is a command injection: a bug that lets someone with admin rights run their own commands on the underlying system.

Each one is serious. Together they're a set of keys. According to Barracuda, an attacker can chain them to gain root access, the highest privileges on the device, without ever knowing a password. The condition is that the attacker can reach the admin interface. If that's exposed to the internet, it's a low bar.

The command injection also affects five other Barracuda products, including the Web Application Firewall and Web Security Gateway. The login bypass, and therefore the full chain, applies only to the ESG. That's your priority.

Why this belongs in the boardroom

Email security feels like a solved problem. There's a box, it filters spam, done. But that box is also where your most sensitive communication converges. Whoever takes it over doesn't read one mailbox; they read the whole company's. Under NIS2, boards must show they manage risks like this, and leaving a known, critical flaw open in your mail infrastructure is hard to defend. Patch management isn't IT housekeeping here. It's liability.

Through the attacker's eyes

At XPOSE, we think like the other side. What follows are scenarios, not a reconstruction of an attack and certainly not a how-to.

The perfect listening post. A state-level attacker (an APT, advanced persistent threat) doesn't want noise. They want to read. An email security gateway sees every message and every attachment go by. Nothing needs to be stolen or encrypted; quietly reading along is enough. An invoice whose bank details change in transit is then only one step away.

Nobody watches the guard. Security appliances are trusted by default. They sit outside your endpoint detection, are rarely logged and even more rarely reviewed. That's exactly what makes them such a comfortable hiding place.

One MSP, a hundred clients. Many SMEs have their mail gateway run by an MSP or hoster. For an attacker that's an efficient model: whoever understands one management portal and knows where a provider's appliances live is looking at an entire client list. Your supply chain becomes your attack surface.

The patch doesn't evict anyone. This is the point most often missed. An update closes the door; it says nothing about who's already inside. The CCB says it plainly: patching protects against future exploitation but does not remediate a past compromise.

History likes to repeat itself. In 2023, a different ESG flaw (CVE-2023-2868) was exploited by Chinese espionage groups, starting as early as October 2022 according to SecurityWeek. Barracuda then told customers to replace compromised appliances. This type of device is already on serious players' radar.

What to do today

1. Check your ESG runs the latest firmware with every patch applied. Don't blindly trust automatic updates; Barracuda warns that devices several versions behind may need more than one update.
2. Take the admin interface off the internet. Reachable only from trusted internal networks. Have someone check what of your environment is publicly visible.
3. Switch automatic patching back on if anyone ever turned it off.
4. Look back, not just forward. Review logs and configuration for unexplained changes, new admin accounts or odd forwarding rules.
5. Ask your MSP in writing: is our appliance patched, when, and who has access to the admin interface?
6. Don't forget the rest. Running Barracuda WAF, Web Security Gateway or Message Archiver? Patch those too. And if you use SolarWinds Dameware for remote support, the CCB also urges you to patch immediately (CVE-2026-28336, CVSS 9.9).

Final thoughts

The mail gateway exists to protect you. That's exactly why it's the last place you'd expect an intruder, and the first place a patient attacker wants to be. There's no confirmed exploitation yet. Use that time.

XPOSE Security tests your environment the way real APT attackers would: from the admin interface accidentally left online to your MSP's access. Better we find it than they do. Get in touch and strengthen your security posture structurally with our CISO as a Service.