CVE-2026-116606: Barracuda Networks Email Security Gateway (ESG) Authentication Bypass Using an Alternate Path or Channel Vulnerability
High⚠ Actively exploited (CISA KEV)
High
Severity
Active
CISA KEV
No
Ransomware use
Nov 13, 2026
Patch deadline
⚠ Exploited in the wild. CISA added CVE-2026-116606 to its Known Exploited Vulnerabilities catalog on Nov 10, 2026, with a federal patch deadline of Nov 13, 2026 — meaning attackers are actively using it. If you run the affected software, patch it immediately.
Barracuda Networks Email Security Gateway (ESG) contains an authentication bypass using an alternate path or channel that could allow an unauthenticated remote attacker to invoke a…
Details
AffectedBarracuda Networks · Barracuda Email Security Gateway (ESG)
WeaknessCWE-288
Added to CISA KEVNov 10, 2026
Federal patch deadlineNov 13, 2026
Known ransomware useNot documented
Frequently asked questions
Is CVE-2026-116606 being actively exploited?
Yes — CISA lists CVE-2026-116606 in its Known Exploited Vulnerabilities (KEV) catalog, so it is confirmed exploited in the wild. Patch it as a priority.
What does CVE-2026-116606 affect?
CVE-2026-116606 affects Barracuda Networks · Barracuda Email Security Gateway (ESG).
How do I fix CVE-2026-116606?
Apply the vendor’s patch for the affected software. The federal patch deadline was Nov 13, 2026. Then check whether your personal data was exposed in any related breach.