Critical Barracuda ESG Bugs Expose Email Gateways to Unauthenticated Takeover

Key points

• CVE-2026-111560 and CVE-2026-116606 affect Barracuda Email Security Gateway appliances.
• Attackers need no credentials and can reach exposed management interfaces remotely.
• Successful exploitation can change global configuration and compromise the appliance.
• Barracuda issued mitigations; admins should assess internet exposure and follow recovery guidance.

Barracuda Networks has disclosed two critical vulnerabilities in its Email Security Gateway (ESG) product line during 2026. The issues are tracked as CVE-2026-111560 and CVE-2026-116606. According to the available facts, a remote attacker who does not need to authenticate can bypass the appliance's authentication controls. That access can then be used to change settings that apply across the entire device and to compromise the appliance itself.

Organizations with ESG units reachable from the public internet are the primary exposure group. That includes school districts, public-sector mail teams, and any IT group that has placed an email gateway management interface directly online. Because these devices sit in the mail path, an intrusion is not just a single-server problem; it can affect how messages are filtered, routed, and trusted.

The timing matters. A 2026 disclosure gives defenders a narrow window to find exposed appliances before opportunistic scanning turns into exploitation. Barracuda's guidance includes mitigations, a configuration import step, and recovery from a backup archive that may have been crafted. Administrators should not assume that an appliance is safe simply because it is behind a vendor-managed update channel.

Watch for signs of unauthorized configuration changes, unexpected import or restore activity, and authentication events that do not map to known administrators. The priority is to determine which ESG appliances are internet-facing, deploy the vendor's mitigations, and follow Barracuda's recovery instructions in the correct order. If compromise is suspected, isolate the unit, preserve evidence, and rebuild from a trusted state rather than restoring unverified data.

What to do now

1. Inventory every Barracuda Email Security Gateway appliance and identify which management or service interfaces are reachable from the public internet; restrict them to trusted admin networks or VPN access.
2. Apply Barracuda's mitigations for CVE-2026-111560 and CVE-2026-116606 immediately, and verify whether updated firmware or vendor patches are available.
3. If compromise is suspected, isolate the appliance, preserve logs and configuration evidence, and follow vendor guidance before performing any configuration import or backup recovery.
4. Use only known-good backup archives and configuration files; do not restore data that may have been crafted or modified by an attacker.
5. Rotate credentials, API tokens, and mail-flow secrets associated with the ESG and connected systems, then review global settings for unauthorized changes.
6. Monitor authentication, configuration import, backup restore, and administrative change logs for anomalous activity, especially from unauthenticated or unfamiliar sources.
7. After recovery, validate mail filtering, routing, and trust settings end to end before returning the appliance to production.

CVE references

• CVE-2026-111560

Original source

CISA Known Exploited Vulnerabilities