CompTIAAvailable
CS0-003
CVE-2026-116606 Barracuda ESG Vulnerability: What to Do
CVE-2026-116606 is a critical authentication bypass in Barracuda Email Security Gateway versions earlier than 9.4.0.030, and CISA lists it as exploited. Here is who is affected and what to do first.
Short answer: CVE-2026-116606 lets an unauthenticated remote attacker rewrite the global configuration of a Barracuda Email Security Gateway by restoring a crafted backup archive. NVD lists versions earlier than 9.4.0.030 as affected, scores it CVSS 9.3 Critical, and CISA added it to the KEV catalog on 2026-11-10. Apply Barracuda's mitigations, check your configuration against a known-good backup, and follow CISA's forensics guidance.
If you run a Barracuda Email Security Gateway (ESG) earlier than 9.4.0.030, treat it as urgent. CVE-2026-116606 lets an unauthenticated attacker over the network change the appliance's global configuration, and CISA lists it as exploited.
This guide covers what the flaw is, who is affected, and the exact checks to run today.
What happened
The NVD record describes an authentication bypass in Barracuda Email Security Gateway. An unauthenticated remote attacker can call a configuration-import function. They can then restore a crafted, compatible backup archive.
The result is unauthorized modification of the appliance's global configuration. The weakness is listed as CWE-288, authentication bypass using an alternate path or channel. NVD published the record on 2026-11-02.
CISA says this flaw can be chained with CVE-2026-111560. Check both on your gateway.
Who is affected
The NVD record names Barracuda Email Security Gateway versions earlier than 9.4.0.030.
Version | Status per NVD |
|---|---|
Earlier than | Affected |
| Not covered by the affected range |
The attacker needs no account and no user action. Any ESG reachable by an attacker is a concern. That usually means gateways with a public address, which mail gateways commonly have.
How serious it is and whether it is exploited
NVD gives it a CVSS 4.0 score of 9.3 Critical. The vector is AV:N/AC:L/AT:N/PR:N/UI:N, with high impact on confidentiality, integrity and availability of the vulnerable system (VC:H/VI:H/VA:H). In plain words: network reachable, easy to attempt, no login, no user interaction.
CISA added it to the Known Exploited Vulnerabilities catalog on 2026-11-10. The federal due date is 2026-11-13. Known ransomware use is listed as Unknown.
A mail gateway sits in the path of all your email. If an attacker changes its configuration, they may alter how mail is filtered or routed. Treat any unexpected change as an incident.
The CISA KEV entry tells you to apply mitigations per vendor instructions and to follow BOD 26-04 and CISA's "Forensics Triage Requirements". If mitigations are unavailable, it says to discontinue use of the product. For cloud services, it points to the applicable BOD 26-04 guidance.
What to do now
Work through these in order.
Find every ESG you own. Include old test units and branch offices.
Check the version. Compare it with
9.4.0.030.Apply the vendor's mitigations and update. Use the Barracuda security notice. Mandiant's technical write-up adds detail. Check both pages for steps that fit your deployment.
Reduce exposure while you work. Limit who can reach the appliance's management and web interfaces.
Check the configuration for tampering. Details below.
Preserve evidence before you rebuild or wipe anything, following CISA's forensics triage guidance.
Find your gateways
Your MX records show which hosts receive mail. Look up each one:
dig +short MX yourcompany.comThen scan the gateway's public name from outside your network. Only scan systems you own.
nmap -Pn -sV --top-ports 1000 mail-gateway.yourcompany.comAny open web or admin port you did not expect should be closed or restricted at the firewall.
Compare configuration with a known-good backup
The attack works by restoring a crafted backup, so the configuration is where you look. Export the current configuration. Keep your last trusted backup from before 2026-11-02 if you have one.
Treat both archives as untrusted data. Extract each into its own new, empty directory, then compare:
mkdir -p /tmp/esg-known-good /tmp/esg-current
tar -xf known-good-backup.tar -C /tmp/esg-known-good
tar -xf current-export.tar -C /tmp/esg-current
diff -r /tmp/esg-known-good /tmp/esg-currentThe archive format depends on your export, so adjust the extract step. Review every difference. Pay attention to admin accounts, mail routing, relay and allow-list settings, and anything you did not change yourself.
If you have no clean backup, record a hash of the current export now so you can detect later changes:
sha256sum current-export.tarWorked example: one gateway, one small team
Say a 40-person company runs one ESG at mail.example.com, version below 9.4.0.030.
Finding | Action |
|---|---|
Gateway is public, config matches the backup | Apply mitigations and update. Keep logs. Monitor for changes. |
Gateway is public, config has changes nobody made | Treat as compromised. Preserve evidence, then follow CISA's forensics triage guidance. |
Mitigations are not available for your model | CISA says to discontinue use of the product. |
Gateway is internal only | Still update. Restrict access in the meantime. |
A useful habit is to write down the date and the person who made each configuration change. That makes unexpected edits much easier to spot next time.
For US federal agencies, the due date of 2026-11-13 is only days away. Other teams do not have a legal deadline, but attackers are already using this flaw.
What IT and security learners can take from this
This bug shows a common pattern: a function meant for admins, such as backup restore, becomes dangerous when an alternate path skips authentication. Defenders should ask what a feature changes, who can reach it, and how they would notice a bad change. Those are core skills in incident response and vulnerability management. If you are building them, the CompTIA CySA+ CS0-003 voucher covers that ground ($224.99, delivered by email within 12 hours). Our ECTHP threat hunting guide shows how to practice hunting for changes like these.
Sources
Questions about this topic
Do I need a password to exploit this Barracuda ESG flaw?
No. NVD describes an unauthenticated remote attacker. The vector shows no privileges required and no user interaction, so any reachable vulnerable gateway is a target.
Which ESG version should I look for?
NVD lists versions earlier than 9.4.0.030 as affected. Check your appliance's version and compare it with that number, then read Barracuda's notice for the steps for your setup.
Why does a crafted backup archive matter?
The attacker restores a crafted, compatible backup through the configuration-import function. That replaces the appliance's global configuration with settings they chose. Comparing your configuration to a trusted backup is how you spot it.
Is the flaw linked to any other CVE?
Yes. CISA says CVE-2026-116606 can be chained with CVE-2026-111560. When you review a gateway, check the status of both.
Is this being used in ransomware attacks?
CISA lists known ransomware use as Unknown. The flaw is still on the KEV catalog as of 2026-11-10, which means it is exploited, so patching should not wait.
