Barracuda has confirmed attacks affecting a small number of organizations, adding exploitation information to its advisory on November 9 at 9 p.m. EST. This follows DaySec’s earlier coverage of the patches.
The attack path requires access to an affected device’s administrative interface. On Email Security Gateway appliances, CVE-2026-116606 permits an authorization bypass without authentication; combined with command injection flaw CVE-2026-111560, it can lead to root access.
Administrators must verify both firmware and security patches. ESG requires BNSF-40425 on firmware 9.4.017 or later, or BNSF-40430 on older firmware. These version branches identify the appropriate patch; running 9.4.017 alone does not establish protection.
The command injection issue also affects five other Barracuda product lines, each with its own patch assignment. Exploiting that flaw alone requires administrative authentication.
Install the latest firmware and confirm that the correct patch arrived. Apply missing patches manually; older devices may need several firmware updates. Restrict administrative access to trusted internal networks.
