CVE entry · CVE-2026-116606

CVE-2026-116606: Barracuda Networks Email Security Gateway (ESG) Authentication Bypass Using an Alternate Path or Channel Vulnerability

Barracuda Networks Email Security Gateway (ESG) contains an authentication bypass using an alternate path or channel that could allow an unauthenticated remote attacker to invoke a configuration-import function and restore a crafted, compatible backup archive, resulting in unauthorized modification of the appliance’s global configuration. This vulnerability can be chained with CVE-2026-111560.

Actively exploited: added to CISA’s KEV catalog on November 10, 2026.
Use by ransomware: not established so far.
Remediation deadline for US federal agencies: November 13, 2026.

Description from CISA’s KEV catalog.

Our analyses

Cybersecurity

Barracuda: two email gateway flaws patched November 2 are already being exploited

The November 2 patches cover six products. Since November 9, Barracuda has reported attacks against "a small number of organizations." The US agency CISA lists the flaws as exploited: here is what to check.

Nov 4, 20263 min read

Alerts and vulnerabilities from CERT Santé, the French healthcare CERT

CVSS 9.8Nov 3

Barracuda - CVE-2026-116606

Patch availableWorkaround available

What to do

Check whether your estate includes Barracuda Networks Barracuda Email Security Gateway (ESG), including internet-facing devices.
Apply the vendor’s patch or mitigations (references below). Failing that, isolate the product or stop using it, as CISA requires of US federal agencies.
An exploited vulnerability has often been used before it was fixed: look for signs of compromise, especially on internet-facing devices.

References

Vendor advisory or reference cited by CISA (trust.barracuda.com)
Vendor advisory or reference cited by CISA (github.com)
NVD entry (NIST)
CISA KEV catalog

Other Barracuda Networks vulnerabilities

CVE-2026-111560Nov 10

Barracuda Networks Multiple Products OS Command Injection Vulnerability

All exploited Barracuda Networks vulnerabilities