Tip: for any security appliance, check today whether its admin page answers from the internet
- List public IPs of ESG, WAF, ADC, Message Archiver and Web Security Gateway boxes, then test the admin ports from outside (a cloud VM or your external scanner), not from the office.
- Restrict the Admin UI to a management network or VPN with an allowlist; Barracuda recommends trusted internal networks only.
- Turn automatic patching back on if it was off, then confirm the device reports the patched firmware.
- Repeat the same check for other edge appliances; most of this year's edge exploitation started at an exposed management page.
Sources: Barracuda Trust Center advisory (updated Nov 9, 2026)