Barracuda flaws CVE-2026-116606 and CVE-2026-111560 are exploited
CISA says two chained Barracuda flaws are exploited. See which Barracuda Email Security Gateway versions are affected and what to do now.
TL;DR: CISA says two Barracuda flaws, CVE-2026-116606 and CVE-2026-111560, are being exploited, and they can be chained. the first affects Barracuda Email Security Gateway releases older than 9.4.0.030, so apply the vendor's fix now.
What happened
On November 10, 2026, CISA added both flaws to its Known Exploited Vulnerabilities catalogue, which means attackers are using them in real attacks. Federal agencies were given until November 13, 2026 to act, a short deadline that signals urgency for everyone else too.
CVE-2026-116606 affects the Barracuda Email Security Gateway. An attacker with no account can reach a function that imports a configuration backup, then load a crafted archive and change the appliance's global settings. The NVD entry rates it critical, with a score of 9.3, and names releases older than 9.4.0.030 as affected.
CVE-2026-111560 is a second flaw in shared Barracuda code, which CISA lists for several Barracuda products, including the Email Security Gateway, load balancer and web application firewall. It lets a logged-in administrator slip commands into the timezone setting, and they then run as root. The NVD entry rates it high, with a score of 8.6. CISA notes that the two can be chained: the first gets an attacker into the configuration, and the second turns that access into full control of the device.
Am I affected?
You are affected if you run a Barracuda Email Security Gateway older than 9.4.0.030, or another Barracuda product listed in the second flaw's catalogue entry. The records do not name a fixed release for the second flaw, so read the vendor's security advisory for the fixed version of each product and apply it. Also review who can reach the appliance's management interface, and look at its configuration for changes you did not make.
How to check with Stackurity
Be clear about the limits: these are network appliances, and Stackurity does not cover network appliance firmware, so it will not find these two flaws on a Barracuda device. Check the appliance's version in its own administration page and compare it with the vendor's advisory. What Stackurity does cover is the rest of your estate: servers, applications, repositories and images are matched against the exploited-vulnerabilities catalogue every hour. See the risk documentation for how exploited issues are ranked first. The core is open source, and Stackurity Cloud has a 14-day free trial without a card: start a free trial.
