If your business relies on Barracuda's Email Security Gateway (ESG) to filter spam and phishing, there's a problem you need to deal with this week, not next month. On 6 November 2026, security researchers at watchTowr Labs published a working proof-of-concept showing that two Barracuda vulnerabilities can be chained together to gain full root access to the appliance, with no login required at all.
That means a device you trust to keep malicious email out of your inbox could, in the wrong hands, become the attacker's entry point into your entire network.
What exactly is broken
Barracuda has confirmed two separate vulnerabilities: a pre-authentication authorization bypass (CVE-2026-116606) and a command injection flaw (CVE-2026-111560), as detailed in Barracuda's own advisory. Neither flaw is catastrophic on its own. The danger is in combining them: an attacker can use the authorization bypass to skip the login screen entirely, then use the command injection flaw to run commands with root privileges, the highest level of access on the system, as reported by The Hacker News.
watchTowr's demonstration, also covered by The Hacker News, removed any doubt that this is a realistic, exploitable attack path rather than a theoretical risk.
Who is affected
The Email Security Gateway is affected by both CVEs. Barracuda has issued patch BNSF-40425 for ESG version 9.4.017 and above, and BNSF-40430 for versions below that. Five other Barracuda products, namely ADC, WAF, WCC, BMA and WSG, are affected only by the command injection flaw (CVE-2026-111560) and need that patch applied, according to Barracuda's advisory.
The good news is that as of 6 November, Barracuda, Mandiant and CISA had not reported any active exploitation, and neither vulnerability appears in the Known Exploited Vulnerabilities (KEV) catalog, per CyberKendra's reporting. The bad news is that the patches have been public since 2 November, and the detailed proof-of-concept is now public too. History shows that the gap between a public PoC and real-world mass exploitation is often measured in days, not weeks.
What to do today
- Check your ESG version and patch status immediately. If you're below 9.4.017, you need BNSF-40430. If you're on 9.4.017 or higher, confirm BNSF-40425 is applied.
- Check any other affected Barracuda appliances (ADC, WAF, WCC, BMA, WSG) and apply the CVE-2026-111560 patch if you haven't already.
- Don't assume auto-update has handled it. Barracuda appliances are often cloud-managed, but with two patches issued within days of each other, it's worth a manual confirmation rather than an assumption.
- Review logs for unusual admin-level activity on the appliance since 2 November, especially commands or processes you don't recognise.
- If you don't know who manages your Barracuda appliance or whether it's patched, that's the actual problem to solve today, not the CVE itself.
The bigger pattern
This is the third security-critical appliance flaw affecting business-facing infrastructure we've flagged in recent days, following issues in SSH on Linux containers and SonicWall's VPN. The pattern is consistent: trusted security and network appliances, exactly the devices SMEs install and then forget about, are increasingly the weak point attackers chain together to get in. AI-assisted vulnerability research is only accelerating how fast these proof-of-concepts move from lab to real-world attack tooling.
For many small and medium businesses in Switzerland, the honest issue isn't awareness, it's capacity. Nobody internally is tasked with tracking every vendor advisory for every appliance on the network. That's precisely the kind of ongoing, unglamorous maintenance that falls through the cracks until something breaks.
Flitz.ai, built by The Mejlerö Company, helps Swiss businesses keep this kind of infrastructure under control through remote and on-site IT support, Microsoft 365 and Windows administration, and security basics like endpoint protection and two-factor authentication, so patch management isn't something you have to remember on your own. If you're unsure whether your mail security or network appliances are current, a free network analysis is a reasonable place to start. We'll keep monitoring this space and reporting on what matters next.
Switzerland.