CISA flags actively exploited Barracuda email gateway flaw in KEV

CISA added CVE-2026-116606 to its Known Exploited Vulnerabilities (KEV) catalogue on 10 November 2026. The entry affects Barracuda Networks Email Security Gateway (ESG) and describes an authentication bypass using an alternate path or channel that can let an unauthenticated remote attacker alter the appliance’s global configuration.

The vulnerability allows an attacker to invoke a configuration-import function and restore a crafted, compatible backup archive without authenticating. The resulting unauthorised configuration change could be chained with CVE-2026-111560, according to the supplied description. The vulnerability has a CVSS score of 9.3, rated Critical. A patch is available; organisations should consult Barracuda’s vendor guidance and the Mandiant disclosure for details.

The KEV listing confirms that the vulnerability is being actively exploited. The available data does not confirm use in ransomware campaigns. CISA set 13 November 2026 as the remediation deadline, giving affected organisations a short period to address exposure.

CISA requires organisations to apply mitigations in accordance with vendor instructions and comply with applicable BOD 26-04 guidance and CISA’s Forensics Triage Requirements. Where mitigations are unavailable, organisations should follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product. Federal Civilian Executive Branch (FCEB) agencies are directly subject to the directive. All organisations should assess each affected asset’s internet exposure and review their exposure to this vulnerability.

For full details, consult the [NVD entry](https://nvd.nist[.]gov/vuln/detail/CVE-2026-116606) and the CISA KEV catalogue.