Field brief
Barracuda ESG CVE‑2026‑116606: Pre‑Auth Bypass Now Exploited
A critical pre‑authentication bypass in Barracuda Email Security Gateway has been actively exploited, giving attackers root access via a two‑CVE chain.
Barracuda Networks’ Email Security Gateway (ESG) suffered a pre‑authentication authorization bypass (CVE‑2026‑116606) that, when chained with CVE‑2026‑111560, lets an unauthenticated attacker gain root access. The flaw, rated CVSS 9.3, was confirmed in the wild on 9 Nov 2026, and a patch (ESG 9.4.0.030) is available. The vulnerability is listed in the CISA KEV catalog with a remediation deadline of 13 Nov 2026. If your on‑premises ESG is below 9.4.0.030 and the Admin UI is reachable from your network, patch immediately to stop the active attack. Monitor your logs for any unusual activity and verify the patch applied. This two‑step exploit bypasses authentication and then injects commands, giving full control over the gateway. The attack chain was observed in the wild, confirming the CVE’s severity. Organizations should apply the patch as soon as possible and verify that the Admin UI is no longer exposed. Regularly review system logs for any unexpected changes. Decryption Digest blog
See what applies to your environment.
Use the Ncerio CVE feed to move from general intelligence to affected products.