CVE-2026-116606Barracuda Email Security Gateway (ESG)

Barracuda Networks Email Security Gateway (ESG) Authentication Bypass Using an Alternate Path or Channel Vulnerability

Exploited in the wild. CISA added it to its Known Exploited Vulnerabilities list on 10 Nov 2026.

Chance of exploitation in 30 daysEPSS

1.6%

0%Higher than 76% of all CVEs

Exploited in the wild: YesPer CISA, listed 10 Nov 2026
Severity: 9.3 of 10Critical, CVSS
Used in ransomware: Not known
US federal deadline: 13 Nov 2026Agencies must fix it by then

Reading the vendor advisory

Fix it in one click

Fix it in your code

Claude Code Codex Cursor Claude Code (web)

Explain it to me

Claude ChatGPT

Each opens with a short prompt that points at Global Hack Map's public runbook for CVE-2026-116606. Nothing runs until you send it.

About this flaw

Barracuda Networks Email Security Gateway (ESG) contains an authentication bypass using an alternate path or channel that could allow an unauthenticated remote attacker to invoke a configuration-import function and restore a crafted, compatible backup archive, resulting in unauthorized modification of the appliance’s global configuration. This vulnerability can be chained with CVE-2026-111560.

Published: 2 Nov 2026
Weakness: CWE-288

What should I do about this?

Advisories and references