Barracuda Networks Email Security Gateway (ESG) Authentication Bypass Using an Alternate Path or Channel Vulnerability
🚨SEVERITY: CRITICAL — CVSS 9.3Security Advisory
TL;DR 📌
- Barracuda Networks Email Security Gateway (ESG) contains an authentication bypass using an alternate path or channel that could allow an unauthenticated remote attacker to invoke a configuration-import function and restore a crafted, compatible backup archive, resulting in unauthorized modification of the appliance’s global configuration. This vulnerability can be chained with CVE-2026-111560.
- Highest CVSS: 9.3 (Critical).
- Listed in CISA KEV (2026-11-10) — this is being exploited in the wild.
- Check the advisory for fixed releases — remediation detail is in the vendor link below.
- CVEs: CVE-2026-116606.
What it is
Barracuda Networks Email Security Gateway (ESG) contains an authentication bypass using an alternate path or channel that could allow an unauthenticated remote attacker to invoke a configuration-import function and restore a crafted, compatible backup archive, resulting in unauthorized modification of the appliance’s global configuration. This vulnerability can be chained with CVE-2026-111560.
For leadership ðŸ§
Executive summary. Risk is Critical (CVSS 9.3) across any Barracuda Networks kit you run. Follow the remediation in the vendor advisory within Immediate — CISA KEV entries carry a federal remediation deadline.
Why it matters:
- Exposure depends on deployment topology and which access paths reach the affected component.
- Treat internet-facing and management-plane instances as higher risk than internal-only ones.
- Keep monitoring for abnormal authentication and configuration events until upgrades complete.
Now / Next / Later:
- Now: confirm whether you run the affected versions, and check exposure of any that are internet-facing.
- Next: apply the remediation the advisory specifies, through an approved change window.
- Later: add a control check so builds cannot drift back onto a vulnerable train.