A critical authentication bypass, tracked as CVE-2026-116606, affects Barracuda Networks’ Email Security Gateway (ESG). An unauthenticated remote attacker can call a configuration-import function and restore a crafted, compatible backup archive. The result is unauthorized modification of the appliance’s global configuration. The flaw affects ESG versions earlier than 9.4.0.030.
NVD rates the flaw 9.8 out of 10 (Critical). CISA added it to its Known Exploited Vulnerabilities (KEV) catalog on 10 November 2026, which confirms that attackers are already using it. Administrators of ESG appliances should treat it as an urgent priority.
What’s affected
- Product: Barracuda Email Security Gateway (ESG)
- Affected versions: all versions earlier than 9.4.0.030
The NVD record lists versions below 9.4.0.030 as affected, which suggests 9.4.0.030 and later are not. However, the advisory data does not explicitly name a fixed release or say how the update is delivered. Confirm the fixed version in Barracuda’s advisory before you rely on it.
The flaw is classed as CWE-288: Authentication Bypass Using an Alternate Path or Channel. A function that should require authentication can be reached without it.
How serious is it
NVD scores the vulnerability 9.8 (Critical) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. In plain terms:
- Network attack vector (AV:N): it can be exploited remotely over the network.
- Low complexity (AC:L): no special conditions are needed.
- No privileges (PR:N): the attacker needs no account or credentials.
- No user interaction (UI:N): no administrator or user has to click anything.
- High impact on confidentiality, integrity and availability (C:H/I:H/A:H): a successful attack can expose data, alter the system and disrupt service.
The appliance’s global configuration controls how it handles mail. An attacker who can rewrite it may be able to change how mail is filtered, routed or protected.
Is it being exploited?
Yes. CISA added CVE-2026-116606 to its Known Exploited Vulnerabilities catalog on 10 November 2026, confirming exploitation in the wild. CISA catalogs it as a “Barracuda Networks Email Security Gateway (ESG) Authentication Bypass Using an Alternate Path or Channel Vulnerability.”
KEV listings come with a required action and a remediation due date for US federal civilian agencies. The record supplied for this article does not include either, so check the CISA catalog entry linked below for the current requirement.
What to do
- Identify your ESG appliances and check which version each one runs. Anything earlier than 9.4.0.030 is affected.
- Update following Barracuda’s security advisory. Confirm there which release fixes the flaw and whether the update is applied automatically.
- Restrict exposure of the appliance’s management interfaces. Do not expose them to the internet, and limit access to trusted administrative networks until you have updated.
- Review the configuration of each appliance for unexpected changes, such as altered routing, filtering or account settings. Check logs for configuration imports or restores you did not perform.
- Follow any additional guidance in Barracuda’s advisory and Mandiant’s disclosure. If you find signs of compromise, follow your incident response process.
