CVE-2026-116606
Barracuda Email Security Gateway (ESG)
What this is
Barracuda Email Security Gateway (ESG) has a flaw that lets an outsider bypass signing in and change the device’s overall settings.
How it can harm you
An attacker who can reach the device over a network can invoke its configuration import function without signing in. Restoring a specially prepared, compatible backup archive lets them change the device’s overall settings without permission or interaction from you.
How urgent it is
This vulnerability is already being used in attacks. Update promptly to prevent attackers from using this flaw to change your device’s settings.
Who is affected
Barracuda Email Security Gateway (ESG) versions earlier than 9.4.0.030 are affected.
What to do
Update Barracuda Email Security Gateway (ESG) to the fixed release 9.4.0.030. Consult the vendor advisory for the update procedure.
How to check your server
Check the installed version of Barracuda Email Security Gateway (ESG) and compare it with the affected and fixed releases in the advisory from Barracuda Networks.
Technical details
- CVE
- CVE-2026-116606
- Published
- November 2, 2026
- CWE
- CWE-288
- CVSS
- 9.3
- CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
- EPSS
- 8.9% chance of an attack attempt in the next 30 days
- Attack evidence
- attacks observed; public exploit on GitHub; Nuclei template
CVSS measures technical severity on a scale up to 10. Attack conditions and urgency are explained above.
EPSS estimates the chance of an exploitation attempt in the next 30 days, not the chance of your server being breached.