Barracuda ESG Exploited: Patch vs Admin UI Lockdown
Barracuda ESG exploited is no longer a theoretical risk. Barracuda Networks confirmed on 9 November 2026 that attackers are chaining CVE-2026-116606 and CVE-2026-111560 against its Email Security Gateway, and CISA added both to its Known Exploited Vulnerabilities catalogue on 10 November with a federal deadline of 13 November. Of the two defences available, patching to firmware 9.4.0.029 or later…
Barracuda Networks confirmed on November 9, 2026 that attackers are exploiting two vulnerabilities - CVE-2026-116606 and CVE-2026-111560 - in its Email Security Gateway (ESG). The vulnerabilities allow a pre-authentication authorisation bypass and command injection, which together can give attackers root access to the device. The Federal Coordination of Vulnerabilities Team (CISA) added the vulnerabilities to its Known Exploited Vulnerabilities catalogue on November 10 with a deadline of November 13 for US federal agencies to take action.
Barracuda recommends applying firmware update 9.4.0.029 or later as the primary defence. As a stopgap, restricting the Admin UI to internal networks offers immediate protection against unauthenticated attackers. The vulnerabilities work together - the first removes the need for credentials, and the second provides code execution.
Patching alone does not remove an existing intruder. Indian organizations running the appliance are obligated to report exploitation to CERT-In within six hours if they detect it.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
