Barracuda ESG Flaws Are Being Exploited: Patch to 9.4.0.029, Then Check for Compromise

Barracuda says two recently patched Barracuda ESG flaws are now being exploited. On November 9, 2026, it updated its advisory to say it has "identified exploitation activity affecting a small number of organizations." Chained together, the two bugs can let an attacker with no password get root access to an Email Security Gateway. The fixed firmware is 9.4.0.029.

The Email Security Gateway sits in front of an organization’s mail server and filters every message coming in. Many nonprofits, schools and local agencies bought one years ago and rarely log in to it. This post covers what Barracuda has published, how to confirm your gateway is patched, and why a patched email gateway still needs a compromise check. Facts are as of the evening of November 10, 2026.

The short version: log in to your Barracuda ESG today and confirm it shows firmware 9.4.0.029 or later. Make sure its admin interface is not reachable from the internet. If the admin page was exposed at any point since early November, treat the gateway as possibly compromised. Contact Barracuda Support and rotate the passwords and keys stored on it.

What Barracuda says about the Barracuda ESG flaws

Barracuda’s Trust Center advisory was first published on November 2, 2026. It covers two CVEs.

• CVE-2026-116606 is a pre-authentication authorization bypass. Barracuda rates it High, with a CVSS score of 9.3. It affects only the Email Security Gateway.
• CVE-2026-111560 is a command injection flaw. Barracuda rates it High, with a CVSS score of 8.6. It affects the ESG and five other Barracuda products.

Barracuda says that "if exploited in combination, these vulnerabilities could allow an attacker to bypass authorization controls and obtain root access to the device." Root is full control of the appliance.

The advisory has two updates. On November 5, Barracuda changed the "Authentication Required" field for CVE-2026-116606 to "No (Administrative UI Access Required)." In plain terms, an attacker needs no login, only network access to the admin web page. On November 9 at 9:00 p.m. EST, Barracuda added the note about exploitation.

Barracuda does not say who is behind the attacks or how many devices are affected beyond "a small number of organizations." It lists no indicators of compromise.

How the chain works, per watchTowr

The research firm watchTowr published a technical write-up on November 5. According to watchTowr, the first bug sits in the ESG’s password change handling. A failed password change request does not stop. It carries on with a low-privilege session.

watchTowr says the second bug sits in the backup restore feature. A crafted backup file can set the system time zone to a value that runs a command. That command runs as root. watchTowr also reports that the checksum guarding backup files uses a secret built into the product, so an attacker can forge it.

watchTowr says it tested firmware 9.4.0.027 as vulnerable and 9.4.0.029 as patched. It published request details and a detection tool on GitHub. Once details like these are public, attacks usually follow. Barracuda’s exploitation note came four days later.

Which products are affected

Barracuda’s table lists six products. The ESG is the only one hit by both bugs, which is why it carries the full root chain.

If you run the Message Archiver or a Barracuda web firewall, patch those too. CVE-2026-111560 needs admin access on its own, so the risk there is lower, but the fix is the same kind of firmware update.

Appliance or cloud: which Barracuda ESG do you have?

Barracuda’s ESG product article on Campus says the flaws affect "All versions of the Email Security Gateway (ESG)." It does not split hardware, virtual and public cloud deployments. If you run the ESG as a virtual machine or in a public cloud account, treat it the same as a box in a rack.

Barracuda also sells a cloud email security service, Barracuda Email Protection, that it runs itself. The advisory does not list it. If you are not sure which one you have, check for a login page on your own network or IP address. If the answer is still unclear, ask Barracuda Support or the partner that sold it to you.

How to confirm your Barracuda ESG is patched

The Campus article gives the steps:

1. Log in to the ESG web interface as an administrator.
2. Go to Advanced, then Firmware Update.
3. Check the Current Installed Version.

If it shows 9.4.0.029 or later, Barracuda says the appliance "has received the update." If it shows an older version, click Update and let the appliance reboot. Then check the version again.

Barracuda notes two catches. Gateways below firmware 9.1 must update in two steps, because they cannot jump straight to 9.4.0.029. And Barracuda’s advisory says a device "multiple versions out of date" may need more than one update.

Barracuda usually pushes patches automatically. Its advisory says that if a patch "has not been automatically applied, customers should manually apply the appropriate patch as soon as possible." If someone turned automatic patching off, Barracuda recommends turning it back on.

Close the Barracuda ESG admin interface to the internet

Barracuda’s advisory says organizations whose admin interfaces "are not publicly accessible from the internet are less exposed." It recommends limiting admin access to trusted internal networks.

The gateway must accept mail from the internet. Its admin web page does not need to. Check your firewall rules, or ask whoever set the gateway up, whether the admin port is open to the world. If it is, close it today, even after patching.

Why a patched Barracuda ESG still needs a compromise check

Patching stops new attacks. It does not remove an attacker who got in before the patch. Root access lets an attacker change the appliance in ways a firmware update may not undo.

Barracuda learned this the hard way in 2023. Its 2023 ESG advisory covered CVE-2023-2868, which attackers had used since October 2022. Barracuda patched every appliance on May 20, 2023. By June 6 it told customers: "Compromised ESG appliances must be immediately replaced regardless of patch version level." Malware on some gateways gave attackers lasting access that the patch did not remove.

Barracuda has not said the 2026 attacks work the same way. But the lesson holds for any email gateway. These are our suggested checks:

• Was the admin page exposed? If yes, and the gateway sat below 9.4.0.029 after November 5, assume it may have been reached.
• Look for odd admin activity. Check for admin accounts you do not recognize, unexpected password changes and backup restores no one asked for. watchTowr’s write-up shows the attack uses the backup restore feature.
• Rotate what the gateway stores. In 2023, Barracuda told affected customers to rotate connected LDAP or Active Directory credentials, Barracuda Cloud Control, FTP and SMB credentials, and private TLS certificates.
• Call Barracuda Support. Its advisory points customers to support@barracuda.com for help checking firmware and patches. Ask whether your device shows any sign of compromise.

CVE and KEV status

As of the November 9 version of CISA’s Known Exploited Vulnerabilities catalog, neither CVE was listed. Barracuda’s exploitation note came the same evening. A listing would add a federal deadline. Do not wait for it.

If you are new to these terms, start with what a CVE is and our explainer on EPSS scores. Our post on the GlobalProtect vulnerability covers the same pattern: an edge device, a patch, then attacks on the boxes that missed it.

This is the third urgent security post we have run today. Our Chrome zero-day post covers browsers, and our N-central post covers MSP tools. Email gateways also work hand in hand with sender checks, which we cover in SPF, DKIM and DMARC explained.

Frequently Asked Questions