What happened. Barracuda first published the two flaws with patches on Nov 2. On Nov 5 it corrected the advisory to say CVE-2026-116606 needs no credentials, only access to the appliance's admin web interface. On the evening of Nov 9 it added that it has identified exploitation activity affecting a small number of organizations. It has not named the attackers, the victims or how many were hit.
How the chain works. CVE-2026-116606 lets an outsider who can reach the admin interface skip the authorization check and change the gateway's global configuration. CVE-2026-111560 is an OS command injection; on its own it needs an admin login, but paired with the bypass it runs commands as root without one. Only the Email Security Gateway (ESG) has both bugs. The command injection alone also affects Barracuda's Load Balancer ADC, Message Archiver, WAF Control Center, Web Application Firewall and Web Security Gateway, each with its own patch.
Why this matters to an enterprise. An email gateway sees every inbound message and often holds mail-flow credentials, so root on it is a quiet foothold. Barracuda ESG was the target of a long China-linked campaign in 2023, and public exploit code has been out since Nov 3. Security Online reported that CISA had not added either CVE to its Known Exploited Vulnerabilities list as of its Nov 9 update.
Do now. Confirm ESG has patch BNSF-40425 (firmware 9.4.017 and later) or BNSF-40430 (earlier firmware), and turn automatic patching back on if it was off. Take the admin interface off the internet and limit it to trusted internal networks. Treat any appliance whose admin interface was exposed before patching as possibly compromised and investigate it, not just patch it.