If your email runs through a Barracuda gateway, check its admin page this week

Barracuda has fixed two flaws in its Email Security Gateway that, used together, can give an attacker root on the box. On Monday night it added a note to say they're now being used in attacks.

If your business has one of these gateways in front of its email, there are two things to check this week: that the patch is on, and that the admin page isn't reachable from the internet.

What happened

Barracuda published a security advisory on 2 November covering two flaws.

The first, CVE-2026-116606, only affects the Email Security Gateway. Barracuda scores it 9.3. It lets someone get past the gateway's permission checks without logging in, as long as they can reach the admin page. Barracuda originally listed it as needing admin access, then corrected that on 5 November.

The second, CVE-2026-111560, scores 8.6. It's a command injection flaw that needs admin access on its own. It affects the Email Security Gateway and several other Barracuda products: the Load Balancer ADC, the Message Archiver, the Web Application Firewall, the WAF Control Center and the Web Security Gateway.

Put the two together and, in Barracuda's words, an attacker can "bypass authorization controls and obtain root access". That's complete control of the machine your email passes through.

On 9 November Barracuda updated the advisory to say it has seen "exploitation activity affecting a small number of organizations". It hasn't said how many. The Register's report has more background.

Does it affect you?

You're in scope if you run any of the six products above. The advisory lists products, not whether they're physical boxes or virtual ones, so assume yours counts until you've checked. The worst case is the Email Security Gateway, because that's the one where both flaws apply.

A lot of small businesses have one of these without really knowing it. It was put in years ago by an IT supplier, it quietly filters spam, and nobody has logged into it since. If you're not sure, ask whoever looks after your IT, or look at your email's MX records. If they don't point straight at Microsoft or Google, something is sitting in between, and it's worth finding out what.

The advisory doesn't mention Barracuda's cloud-hosted email service, so I wouldn't guess either way. If that's what you use, ask Barracuda or your supplier directly.

The big factor is the admin page. Barracuda says exploitation "requires an attacker to have access to the administrative interface". If yours can only be reached from inside the office, you're far less exposed. If it's open to the whole internet, anyone can try.

What to do this week

1. Check the patch is on. Barracuda says that if a patch "has not been automatically applied", customers should apply it manually as soon as possible. For the Email Security Gateway the patches are BNSF-40425 (for firmware 9.4.017 and later) and BNSF-40430 (for anything older). The advisory lists the patch numbers for the other products too, and links to a guide on applying them.

2. Make sure firmware is current. Barracuda also asks customers to run the latest firmware. If the box is several versions behind, it may take more than one update to get there, so don't expect a five-minute job.

3. Turn automatic patching back on. If someone switched it off at some point, Barracuda recommends switching it back on.

4. Lock down the admin page. This is the one I'd do today. Barracuda recommends restricting admin interfaces "to trusted internal networks". In practice that means a firewall rule so only the office network, or a VPN, can reach it. Test it from your phone on 4G afterwards: the admin login page shouldn't load.

5. Ask for help if you're unsure. Barracuda's support address is support@barracuda.com, and it offers help checking firmware and applying patches.

What the advisory doesn't tell you

There are no signs of compromise to look for in the advisory, and no detail on how the attacks worked. So if your admin page has been open to the internet and the patch wasn't on before this week, I'd treat the box as possibly tampered with. Change the admin passwords once it's patched, and talk to Barracuda support about what to check. That's a judgement call rather than anything Barracuda has said, but it's a cheap precaution on the machine that sees all your email.

The bigger point

This is the same lesson as the SonicWall VPN flaw last week. The boxes that sit at the edge of your network, filtering email or letting staff in remotely, are exactly the ones attackers go after. And they're the ones most likely to be forgotten, because they just work.

It's worth making a list of every one of them: what it is, who installed it, how it gets updates and whether its admin page faces the internet. If that list is hard to write, that's useful to know.

The same goes for software. If a bespoke app was built by someone who's since moved on, the team at Dev Partners take on existing systems and keep them patched month to month. For the network and servers, that's the kind of tidy-up I do.