Summary
Barracuda Networks Email Security Gateway (ESG) contains an authentication bypass using an alternate path or channel that could allow an unauthenticated remote attacker to invoke a configuration-import function and restore a crafted, compatible backup archive, resulting in unauthorized modification of the appliance’s global configuration. This vulnerability can be chained with CVE-2026-111560.
- Vendor
- Barracuda Networks
- Product
- Barracuda Email Security Gateway (ESG)
- Added to KEV
- Nov 10, 2026
- Remediation due
- Nov 13, 2026 (US federal deadline)
- Ransomware use
- Not known
- Weakness
- CWE-288
- EPSS
- 1.6% as of Nov 10
In the news · last mention Nov 9
References