CISA has confirmed active exploitation of CVE-2026-116606, an authentication bypass in Barracuda Email Security Gateway. The flaw lets an unauthenticated remote attacker change the appliance's global configuration. Federal remediation is due by November 13, 2026.
What Is It
CVE-2026-116606 is an authentication bypass in Barracuda Networks Email Security Gateway (ESG). It works through an alternate path or channel (CWE-288). An unauthenticated remote attacker can call a configuration-import function and restore a crafted backup archive that the appliance accepts as compatible. This lets them change the appliance's global configuration without authorization. CISA notes that this flaw can be chained with CVE-2026-111560.
Mandiant reported the vulnerability (MNDT-2026-0042). It was published to NVD on November 2, 2026. NVD's analysis is still in progress.
Why It Matters
- Active exploitation confirmed: CISA added the CVE to the Known Exploited Vulnerabilities (KEV) catalog on November 10, 2026. CISA's SSVC assessment rates exploitation as "active," automatable as "yes" and technical impact as "total."
- Critical severity: Mandiant assigned a CVSS v4.0 base score of 9.3 (Critical). An attacker can exploit it over the network with low complexity, no privileges and no user interaction. Impact to confidentiality, integrity and availability is high.
- Forensic triage required: The KEV entry marks forensic triage as required. Treat this as a possible compromise, not just a patching task.
- Short deadline: The KEV due date is November 13, 2026, three days after the CVE was added.
- Ransomware use: Listed as "Unknown."
What's Vulnerable
- Vendor: Barracuda Networks
- Product: Barracuda Email Security Gateway (ESG)
- Affected versions: All versions earlier than 9.4.0.030
Patch Status
NVD lists versions before 9.4.0.030 as affected. Barracuda's security advisory is linked below.
CISA's required action is to apply mitigations according to the vendor's instructions. Federal civilian executive branch (FCEB) agencies must also follow BOD 26-04 ("Prioritizing Security Updates Based on Risk") and CISA's "Forensics Triage Requirements." Binding operational directives apply only to those agencies. Other organizations are not bound by BOD 26-04, but CISA recommends they use the KEV catalog to prioritize their own fixes. For cloud services, follow the applicable BOD 26-04 guidance. If no mitigations are available, stop using the product. Stakeholders should check each asset's internet exposure and follow the BOD 26-04 patching guidelines.
Because this CVE can be chained with CVE-2026-111560, defenders should check their exposure to both.