Skip to content
NewA calmer, faster ZeroHour
Exploit / PoChighExploited in the wild

CISA lists Barracuda ESG auth bypass in KEV (CVE-2026-116606)

Original title: CISA KEV: Barracuda Networks Email Security Gateway (ESG) Authentication Bypass Using an Alternate Path or Channel Vulnerability — Barracuda Networks Barracuda Email Security Gateway (ESG) (CVE-2026-116606)

CISA Known Exploited Vulnerabilities ()1 min read1
Read at cisa.gov
Part of a story covered by 10 sourcesBarracuda ESG flaws chained for root; limited exploitation confirmedMerged summary & timeline
AI summary · x-ai/grok-4.7Summaries by Vani AI

An unauthenticated attacker can restore a crafted backup and change global configuration; the due date is November 13.

CISA added CVE-2026-116606, an authentication-bypass flaw in Barracuda Networks Email Security Gateway, to the Known Exploited Vulnerabilities catalog. An unauthenticated remote attacker can invoke configuration import and restore a crafted compatible backup, modifying the appliance’s global configuration. CISA says it can be chained with CVE-2026-111560. The due date is November 13, and ransomware use is unknown.

Unconfirmed: Known ransomware campaign use is unknown.

Key facts
  • The bypass uses an alternate path or channel.
  • The imported archive must be a crafted, compatible backup.
  • Vendor mitigations and BOD 26-04 compliance are required.
  • No fixed ESG version is stated.
Security assessment · AI, from the articleExploited in the wild

Impact: unauthenticated remote modification of global configuration

ProductAffected
Barracuda Networks Email Security Gateway (ESG)—
What to do
  1. 1.Apply vendor mitigations and follow BOD 26-04 guidance.
  2. 2.Discontinue ESG use if mitigations are unavailable.
  3. 3.Complete the required action by November 13.
Analyze CVE-2026-116606 with Vani AIImpact, affected versions, exploitation, mitigations and detection
CVEs
CVE-2026-116606
ATT&CK
T1190 Exploit Public-Facing Application
Tags
cisa-kevbarracudaesgauthentication-bypassbod-26-04
Vendors
Barracuda Networks
Products
Email Security Gateway
Organizations
CISA

Vulnerabilities mentioned

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2026-116606
Auth bypass in Barracuda Email Security Gateway before 9.4.0.030
9.32%KEVPoC
KEV

From the original article

1 min read at cisa.gov

Barracuda Networks Email Security Gateway (ESG) contains an authentication bypass using an alternate path or channel that could allow an unauthenticated remote attacker to invoke a configuration-import function and restore a crafted, compatible backup archive, resulting in unauthorized modification of the appliance’s global configuration. This vulnerability can be chained with CVE-2026-111560.

CISA Known Exploited Vulnerabilities

cisa.gov

Read the full article at CISA Known Exploited Vulnerabilities

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.