Barracuda Networks Email Security Gateway (ESG) Authentication Bypass Using an Alternate Path or Channel Vulnerability
Barracuda Networks — Barracuda Email Security Gateway (ESG)
- Added to KEV catalog
- 10 November 2026
- Federal remediation due date
- 13 November 2026
- Weakness classification (CWE)
- CWE-288
AI Breakdown
What it is
Barracuda Email Security Gateway contains a flaw that allows unauthenticated remote attackers to bypass authentication controls. Attackers can invoke a configuration-import function and upload a crafted backup archive to alter the appliance global configuration. This vulnerability affects versions earlier than 9.4.0.030 and can be chained with CVE-2026-111560.
Why it matters
This issue is listed as an actively exploited vulnerability, making it an immediate threat to organizations operating vulnerable email gateways. Although known ransomware campaign use is currently unknown, unauthorized modification of email gateway configurations can expose sensitive communications and open pathways into internal networks. The active exploitation status demands urgent prioritization to prevent network compromise.
Recommended action
Apply vendor-provided mitigations and updates immediately, ensuring all internet-exposed appliances are prioritized and remediated. Conduct forensics triage in accordance with CISA guidance to identify any potential signs of unauthorized configuration changes or breach activity. If vendor mitigations cannot be implemented, immediately isolate or discontinue use of the affected product.
AI-generated from CISA and NVD data — treat as a starting point, not a substitute for your own risk assessment.
CISA Description
Barracuda Networks Email Security Gateway (ESG) contains an authentication bypass using an alternate path or channel that could allow an unauthenticated remote attacker to invoke a configuration-import function and restore a crafted, compatible backup archive, resulting in unauthorized modification of the appliance’s global configuration. This vulnerability can be chained with CVE-2026-111560.
Required action
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Notes
https://trust.barracuda.com/security/pre-authentication-authorization-bypass-command-injection ; https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2026/MNDT-2026-0042.md ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-116606
NVD Technical Description
An authentication bypass in Barracuda Email Security Gateway versions earlier than 9.4.0.030 allows an unauthenticated remote attacker to invoke a configuration-import function and restore a crafted, compatible backup archive, resulting in unauthorized modification of the appliance’s global configuration.
More Barracuda Networks Vulnerabilities
Is this vulnerability present in your environment?
CRS delivers independent VAPT assessments that identify exactly which known-exploited vulnerabilities exist in your network, applications, and infrastructure.
Explore VAPT Services