Barracuda Email Security Gateway: CVE-2026-116606 Exploited

What it is and who is affectedBarracuda Networks has disclosed an authentication bypass in its Email Security Gateway (ESG) appliances, tracked as CVE...

What it is and who is affected

Barracuda Networks has disclosed an authentication bypass in its Email Security Gateway (ESG) appliances, tracked as CVE-2026-116606 and classified under CWE-288 (authentication bypass using an alternate path or channel). According to the National Vulnerability Database (NVD) of NIST, the flaw affects Barracuda Email Security Gateway firmware versions earlier than 9.4.0.030, across the ESG 300, 400, 600, 800 and 900 hardware models.

The mechanism is worth understanding, because it explains why the impact is so broad. An unauthenticated remote attacker can reach a configuration-import function through an alternate path and restore a crafted, compatible backup archive. In practice, that means someone with no credentials at all can rewrite the appliance's global configuration. CISA notes that the vulnerability can be chained with CVE-2026-111560, which raises the risk of a single entry point turning into a wider compromise.

The severity is CVSS 4.0 score of 9.3, rated CRITICAL. The vector shows network attack, low complexity, no privileges required and no user interaction, with high impact on confidentiality, integrity and availability. The flaw was published in the NVD on 2 November 2026.

For small and mid-sized organisations in Spain and Catalonia, the relevant question is simple: does your mail gateway sit in front of your corporate email? If it is a Barracuda ESG appliance on an older firmware branch, this concerns you directly, whether you run it on-premises in Barcelona, Lleida, Tarragona or Girona, or rely on a managed IT provider to look after it.

Why it is urgent

This is not a theoretical weakness waiting for a researcher's proof of concept. CVE-2026-116606 is confirmed as exploited in the wild, and CISA added it to its Known Exploited Vulnerabilities (KEV) catalogue on 10 November 2026.

The deadline CISA set for US federal agencies to remediate was 13 November 2026, only three days later. That short window reflects how the agency reads the exposure: an internet-facing appliance, an unauthenticated path in, and a configuration function that can be abused without any credentials.

CISA's required action is to apply mitigations in accordance with the vendor's instructions, following its BOD 26-04 guidance on prioritising security updates by risk and its forensics triage requirements. Where mitigations are unavailable, the guidance for cloud services is to discontinue use of the product. It also asks asset owners to evaluate each device's internet exposure. The KEV entry does not list known use in ransomware campaigns, but absence of that note is not reassurance: an attacker who can rewrite the global configuration of a mail gateway has a foothold that can be reused later.

What to do today

The first step is inventory, not panic. Confirm whether any Barracuda Email Security Gateway is in service and, if so, which firmware version it runs. Anything below 9.4.0.030 falls inside the affected range described by the NVD.

Check the version of every ESG 300, 400, 600, 800 and 900 unit you operate or inherit from a provider, including secondary or standby appliances that are easy to forget.
Apply the update or mitigation exactly as set out in Barracuda's vendor advisory. If the advisory does not specify a corrected build for your model, follow whatever the manufacturer instructs rather than assuming a version number.
Look for signs of intrusion. Because the flaw allows a crafted backup archive to be restored, review configuration changes, unexpected imports and administrative activity on the appliance around the period it was exposed.
Reduce what is reachable from the internet. Restrict management interfaces and configuration functions to trusted networks or VPN access, and review firewall rules in front of the gateway.
Document the decision for your GDPR records: what was affected, when it was patched and what was reviewed afterwards.

If you cannot mitigate promptly, treat the appliance as compromised until you can prove otherwise, and consider whether mail flow can be routed elsewhere in the meantime.

How a cybersecurity team can help

Situations like this one reward preparation more than improvisation. At ALMC we work with SMEs, online shops and small IT teams across Catalonia on exactly this kind of exposure: auditing which services are visible from the internet, hardening servers and CMS platforms such as WordPress, PrestaShop and Joomla, and keeping patches under control before a CVE turns into an incident.

When a critical flaw is already being exploited, our work shifts to rapid triage: confirming versions and exposure, applying the vendor's guidance, reviewing logs for configuration tampering, and cleaning up if an appliance or website has been compromised. For organisations without a dedicated security function, that external pair of eyes is often the difference between a maintenance task and a very bad week.

Is your business exposed to flaws like this?

ALMC checks which versions you are running, applies the patches and hardens your servers and website. Contact our team for a security review.

Results without leaving the page.