CVE-2026-116606 (Barracuda Networks Barracuda Email Security Gateway (ESG))

Plain-English Summary

CVE-2026-116606 is a confirmed actively exploited vulnerability affecting Barracuda Networks Barracuda Email Security Gateway (ESG). Tracked in the CISA Known Exploited Vulnerabilities (KEV) catalog as Barracuda Networks Email Security Gateway (ESG) Authentication Bypass Using an Alternate Path or Channel Vulnerability, this flaw carries a CVSS base score of 9.3 (CRITICAL) and an EPSS exploitation probability of 8.93%. Because real-world threat actors are actively abusing this weakness in production environments, defenders and system administrators must treat patching or network-level isolation as an immediate priority rather than waiting for routine maintenance cycles.

According to defensive advisory data, Barracuda Networks Email Security Gateway (ESG) contains an authentication bypass using an alternate path or channel that could allow an unauthenticated remote attacker to invoke a configuration-import function and restore a crafted, compatible backup archive, resulting in unauthorized modification of the appliance’s global configuration. This vulnerability can be chained with CVE-2026-111560. Organizations running exposed or unpatched instances of Barracuda Networks Barracuda Email Security Gateway (ESG) face heightened operational risk, including unauthorized access, service disruption, or lateral movement depending on deployment architecture. Ransomware campaign association is currently recorded as 'Unknown'. If your environment exposes Barracuda Email Security Gateway (ESG) to untrusted networks, remote users, or partner integrations, prioritize verification of your current software build today.

Affected Products & Versions

Vendor	Product	Weakness	Status
Barracuda Networks	Barracuda Email Security Gateway (ESG)	CWE-288	Affected (Verify Build)

How to Fix & Patch

Recommended Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Always verify cryptographic checksums on vendor packages, test updates in a staging tier when feasible, and confirm the patched build number across all production nodes and disaster-recovery replicas.

Workarounds & Temporary Mitigations

If an immediate maintenance window is unavailable for Barracuda Networks Barracuda Email Security Gateway (ESG), reduce exposure by restricting administrative interfaces behind VPN or zero-trust access proxies, enforcing strict egress firewall rules, and enabling multi-factor authentication on all management endpoints. Review vendor release notes for temporary configuration flags or disabled-by-default mitigations.

Detection & Log Indicators

Defenders should audit perimeter firewall logs, authentication telemetry, and endpoint EDR alerts around Barracuda Email Security Gateway (ESG) processes. Look for unexpected child process execution, anomalous outbound connections, or sudden configuration changes. Search community Sigma detection repositories for CVE-2026-116606 or CWE-288 behavioral rules and correlate events against CISA's 2026-11-10 advisory timeline.

Search SigmaHQ Rules for Barracuda Networks / Barracuda Email Security Gateway (ESG) detections.
Review CISA KEV Catalog due date: 2026-11-13.

Frequently Asked Questions

Is CVE-2026-116606 actively exploited in the wild?

Yes. CISA added CVE-2026-116606 (Barracuda Networks Barracuda Email Security Gateway (ESG)) to the Known Exploited Vulnerabilities catalog on 2026-11-10, confirming active real-world exploitation.

How do I fix CVE-2026-116606 on Barracuda Networks Barracuda Email Security Gateway (ESG)?

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Check the official vendor advisory linked in the references section for exact version numbers.

What is the CVSS and EPSS score for CVE-2026-116606?

CVE-2026-116606 holds a CRITICAL rating (CVSS 9.3) and a FIRST EPSS exploitation probability of 8.93%.

What if I cannot patch Barracuda Email Security Gateway (ESG) immediately?

Isolate management interfaces from public internet access, enforce strict network segmentation, and monitor Barracuda Email Security Gateway (ESG) logs for anomalous activity until patched.

Official References

Last updated: 2026-11-13 · Defensive guidance only (no exploit code).