An attacker who could reach the administrative interface of a vulnerable Barracuda Email Security Gateway could combine two flaws to gain root access, the highest level of control on the device. Barracuda said on Nov. 9 that it had observed exploitation affecting a small number of organizations. The company did not give an exact count in its advisory.
On Nov. 10, the Cybersecurity and Infrastructure Security Agency added both flaws, CVE-2026-116606 and CVE-2026-111560, to its Known Exploited Vulnerabilities Catalog. It listed a Nov. 13 remediation deadline and marked both entries for forensic triage. The Nov. 13 date is the federal remediation deadline. CISA explained in a Nov. 9 bulletin that Binding Operational Directive 26-04 applies to federal civilian executive branch agencies.
The distinction is in how the two flaws work. According to Barracuda’s product advisory, the first flaw lets an attacker bypass authentication on the Email Security Gateway if the attacker can reach its administrative interface. The second lets an attacker with administrative access run commands with root privileges. The gateway is the only product Barracuda lists as affected by both flaws; five other products in the advisory are listed for the command injection flaw alone.
For gateway administrators, the first check is who can reach the administrative interface. Barracuda recommends limiting that access to trusted internal networks. Then check the firmware and patch status on the device: Barracuda lists patch BNSF-40425 for gateway firmware 9.4.017 and later and BNSF-40430 for earlier firmware. The company advises customers to apply the appropriate patch manually as soon as possible if it did not install automatically, and says devices several versions behind may need more than one firmware update.
The remaining question is whether someone got in before the fix. An installed patch answers which protection is in place now. It cannot tell an administrator who reached the device earlier. That is why the catalog’s forensic triage flag matters even when the gateway is already patched.