Security AlertCritical
Barracuda says attackers are exploiting two Email Security Gateway flaws
Nov 10, 2026 · Summarized by Fundy Tech from 2 sources
The 30-second version
Barracuda says two ESG vulnerabilities are being used in attacks and can lead to root access. Customers should patch and restrict admin interface access.
Key points
- The flaws are tracked as CVE-2026-116606 and CVE-2026-111560.
- Barracuda says successful attacks require access to the Admin UI.
- The company says only a small number of organisations are affected so far.
Why it matters
Email security gateways protect business mail and attachments, so a compromise can affect company accounts and messages. Small businesses using Barracuda should patch quickly and limit who can reach the admin interface.
Who’s affected: Barracuda Email Security Gateway customers
What to do
- Apply Barracuda patches immediately.
- Restrict Admin UI access to trusted internal networks.
- Turn on automatic patching if it is disabled.
Vulnerability IDs
Original reporting
Not sure if this affects you?
Fundy Tech helps businesses and households across Atlantic Canada stay patched, protected and up to speed. Tell us what you’re running and we’ll tell you straight whether you need to act.