Barracuda ESG flaw lets attackers alter configuration

What happened

A weakness in how the Email Security Gateway (ESG) from Barracuda Networks checks logins allows attackers to skip authentication entirely. Tracked as CVE-2026-116606, it is classified as CWE-288, authentication bypass using an alternate path or channel. A remote attacker who has not logged in can reach a function meant for importing configuration and use it to load a specially prepared backup file that the appliance accepts as compatible. The result is unauthorized changes to the device's global settings.

The flaw is being actively exploited. CISA added it to its Known Exploited Vulnerabilities catalog on 2026-11-10. The CVE was published on 2026-11-02, and NVD analysis is still underway. The Dutch National Cyber Security Centre (NCSC-NL) has also covered the issue in advisory NCSC-2026-0465.

Who is affected

The flaw affects Barracuda Networks Email Security Gateway (ESG) versions earlier than 9.4.0.030. Organizations running an ESG appliance on an older version should treat it as vulnerable. No other products are listed in the data available to us.

How serious is it

The flaw carries a CVSS 4.0 base score of 9.3, rated critical. It can be triggered over the network with low complexity, needs no privileges and no user interaction, and has high impact on confidentiality, integrity and availability of the appliance.

Active exploitation raises the urgency considerably. CISA has set a remediation due date of 2026-11-13 for US federal agencies. The EPSS score, an estimate of how likely exploitation is, stands at 0.01602 as of 2026-11-10, but confirmed real-world attacks outweigh that estimate. Because email gateways typically sit at the network edge, a tampered configuration could affect mail handling for an entire organization.

What you should do

1. 1Identify all Barracuda Email Security Gateway appliances and check their installed version.
2. 2Update any appliance running a version earlier than 9.4.0.030 following Barracuda's advisory.
3. 3Apply Barracuda's mitigations in line with vendor instructions, as CISA requires, by 2026-11-13 where that deadline applies.
4. 4Review appliance configurations for unexpected changes and follow CISA's forensic triage guidance if compromise is suspected.
5. 5Consult NCSC-NL advisory NCSC-2026-0465 and monitor Barracuda for further updates.

Quick facts