# [CVE-2026-116606] Barracuda Networks Barracuda Email Security Gateway (ESG) Barracuda Networks Email Security Gateway (ESG) Authentication Bypass Using an Alternate Path or Channel Vulnerability
**Severity:** HIGH | **CVSS Base Score:** 7.8 (3.1)
**CVSS Vector:** `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N`
**EPSS Exploit Probability:** 8.93% (Percentile: 95.31%)
**CISA KEV (In The Wild):** YES (Due: 2026-11-13)
**Known Ransomware Campaigns:** Unknown
**Exploit Status:** active_wild
**Published:** 2026-11-10 | **Updated:** 2026-11-13

## Executive Summary
Barracuda Networks Email Security Gateway (ESG) contains an authentication bypass using an alternate path or channel that could allow an unauthenticated remote attacker to invoke a configuration-import function and restore a crafted, compatible backup archive, resulting in unauthorized modification of the appliance’s global configuration. This vulnerability can be chained with CVE-2026-111560.

## Common Weakness Enumeration (CWE)
- **CWE-288**: Common Weakness Enumeration Flaw

## Affected Vendors & Products
- **Vendor:** Barracuda Networks | **Product:** Barracuda Email Security Gateway (ESG)
  - **Affected Versions:** All vulnerable builds prior to vendor emergency patch
  - **Patched Version:** Refer to vendor advisory for patch release

## Technical Root Cause Analysis (AI Defense Agent)
Vulnerability in Barracuda Email Security Gateway (ESG) allowing anomalous execution paths when processing untrusted input.

## Exploitation Mechanism & Attack Scenario
Threat actors issue specially crafted requests to the target service to exploit memory corruption or logic flaws.

## Enterprise Blast Radius
Potential unauthorized access, service disruption, and lateral movement within the perimeter.

## Remediation & Mitigation Playbook
1. Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
2. Apply security updates according to vendor instructions.
3. Ensure network firewalls restrict exposure of administrative ports.

## Detection Guidance & Telemetry
Monitor endpoint execution logs and network traffic for unusual connections originating from Barracuda Email Security Gateway (ESG).

### Sigma Detection Rule
```yaml
title: Suspicious CVE-2026-116606 Activity
status: high
logsource:
  category: process_creation
detection:
  selection:
    CommandLine|contains: 'CVE-2026-116606'
  condition: selection
```


## References
- [CISA KEV Catalog Reference](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-116606) (cisa)
- [NVD Official Detail](https://nvd.nist.gov/vuln/detail/CVE-2026-116606) (advisory)