How to Fix CVE-2026-111560: Patch and Mitigation Steps

The two-minute check

1. Look at the physical label on the device, or the login page of its admin console, for the model number.
2. Confirm the model reads 300, 400, 600, or 800.
3. Open the system or "Basic" page in the admin console and confirm it identifies itself as an Email Security Gateway.
4. List everyone who currently holds an administrator-level login on that device.

When you can stop reading

The record covers only Barracuda Email Security Gateway 300, 400, 600, and 800 hardware and firmware. If you don't run one of those models, this specific flaw does not apply to you. You can stop reading here.

What the official record says

The National Vulnerability Database (NVD) scores this flaw 7.2 HIGH on the Common Vulnerability Scoring System (CVSS), version 3.1 (NVD). The scoring details show the gateway is reachable over the network. They also show low attack complexity and no need for a user to click anything. However, the attacker must already hold a high-privilege administrator login before they can use this flaw.

The Exploit Prediction Scoring System (EPSS) puts this flaw's 30-day exploitation probability at 6.2%, in the 94th percentile of scored vulnerabilities (EPSS). That is a real but far from certain chance of exploitation in the next 30 days. EPSS forecasts exploitation activity over the coming month. It is not a measure of how severe the flaw itself is.

This flaw is also listed on the Known Exploited Vulnerabilities (KEV) catalog maintained by the Cybersecurity and Infrastructure Security Agency (CISA KEV). That listing means criminals are already using this flaw. The federal government set a remediation due date of November 13, 2026 for agencies running this software.

What that means for a business like yours

An attacker needs a working administrator login before they can use this flaw. That requirement limits who can pull it off. It does not remove the risk. Stolen passwords, weak passwords, leftover vendor accounts, and phishing can all hand an attacker that access. Once they have it, they can run commands with full control over the device. That includes reading, changing, or shutting down what the gateway does to your email.

If someone else manages your IT

Send this to your provider today. Short, specific requests get faster answers.

• "Please confirm whether we run Barracuda Email Security Gateway 300, 400, 600, or 800."
• "If we do, please apply the vendor's fix for CVE-2026-111560."
• "Please confirm in writing when that work is complete."

If you don't have a provider handling this already, LayerLogix's managed IT services team can take it from here.

If you manage it yourself

1. Log into the gateway's admin console using your administrator account.
2. Open the "Advisories" or "Firmware" section of the dashboard.
3. Read the vendor advisory for this flaw.
4. Follow the vendor's instructions to apply the fix. The record does not name a fixed version number, so check the vendor's advisory for the current version.
5. Restart the device only if the advisory tells you to.
6. Review your list of administrator accounts. Remove any you don't recognize.

This flaw is on the CISA Known Exploited Vulnerabilities catalog (CISA KEV). That means attackers are already using it. The honest answer on timing is now. The federal due date for this flaw was November 13, 2026. Treat that same date as your own deadline, even if you're not a federal agency.

Don't just trust a progress bar or a success message. Log back into the admin console after the update finishes. Check the version or build listed on the system page. Compare it against the version named in the vendor's advisory. Then test that an admin login still works. Confirm the timezone setting still saves correctly without errors.

• Limit who holds administrator-level logins to a short, trusted list. This will not fix the flaw. It does shrink the pool of people who could misuse it. LayerLogix's privileged access management work is built around exactly this kind of cleanup.
• Put the admin console behind a virtual private network (VPN), or restrict access by IP address. This will not patch the flaw. It keeps the console away from the open internet.
• Watch admin account activity and logs closely. This will not stop an attack. It helps you catch one sooner.
• Ask LayerLogix's cybersecurity team to review your gateway configuration. This does not replace the vendor fix. It adds a second set of eyes.

Do I have to do anything if I only use this gateway at home?

Email Security Gateway devices are built for business networks, but the flaw itself doesn't care where the device sits. Check the model number. If it matches, apply the vendor's fix the same way a business would.

Will applying the fix break anything?

The record doesn't say whether the fix changes any other settings. Follow the vendor's advisory closely. Keep a backup of your current configuration before you start, just in case.

What if we don't know which gateway model we have?

Check the physical label on the device or the system page in the admin console. If you still aren't sure, ask your IT provider to confirm the model for you.

Does this affect anything else on our network?

The record covers only Barracuda Email Security Gateway 300, 400, 600, and 800 hardware and firmware. It does not list any other product. If you handle regulated data on separate systems, review your obligations under our HIPAA compliance guidance or the FTC Safeguards Rule separately.

Who can actually exploit this?

The scoring details show the attacker needs an existing administrator-level login. They don't need you to click a link. The gateway just needs to be reachable over the network.

LayerLogix brings 20+ years of experience and 100% U.S.-Based Support to issues exactly like this one. If you want a second set of eyes on your Barracuda gateway or your wider network, request a free IT assessment or contact us and we'll walk through it with you.