How to Fix CVE-2026-116606 in Barracuda Networks Barracuda Email Security Gateway (ESG)

The two-minute check

1. Log in to the Barracuda Email Security Gateway (ESG) admin interface over a trusted connection.
2. Open the Basic or Firmware page and find the version number shown.
3. Compare it to version 9.4.0.030, the version named in the official record (NVD).
4. If your version is older than 9.4.0.030, treat your gateway as exposed.

When you can stop reading

The record names only Barracuda Networks Barracuda Email Security Gateway (ESG) as affected. If you don't run this appliance anywhere in your business, this flaw does not apply to you. You can close this tab.

What the official record says

This flaw carries a Common Vulnerability Scoring System (CVSS) score of 9.3, rated CRITICAL (NVD). The scoring details show it can be reached over a network, needs no special access, and needs no one to click anything (NVD). In plain terms, anyone who can reach your gateway online can attempt this, with no login and no help from your staff.

The Exploit Prediction Scoring System (EPSS) estimate is 1.6%, placing it in the 76th percentile of all scored flaws (FIRST.org). That is a low chance of exploitation in the next 30 days. EPSS is a forecast of exploitation activity, not a measure of how damaging the flaw is.

This flaw is listed on the Known Exploited Vulnerabilities (KEV) catalog kept by the Cybersecurity and Infrastructure Security Agency (CISA). That listing means criminals are already using this flaw, not just testing it in a lab.

What that means for a business like yours

A successful attack lets someone rewrite your gateway's configuration without ever logging in. That can redirect mail flow, disable filtering, or open a path deeper into your network. For a small or midsize business, that is a direct hit on the system that screens every email reaching your staff.

If someone else manages your IT

Ask your provider directly whether your Barracuda Email Security Gateway (ESG) is affected by CVE-2026-116606. You can send them this wording.

"Please check our Barracuda Email Security Gateway (ESG) firmware version. Confirm whether it is version 9.4.0.030 or newer. If it is older, please restrict admin access and tell me the plan."

A provider offering managed IT services should be able to answer within a business day.

If you manage it yourself

1. Open the gateway's admin interface over a trusted connection.
2. Go to the firmware or version page and write down the number shown.
3. Compare it to version 9.4.0.030 from the official record (NVD).
4. If you are below that version, update to version 9.4.0.030 or later, following the vendor's advisory (Barracuda Trust Center).
5. Restrict the management interface so only trusted addresses can reach it.
6. Review the appliance's configuration for any changes you don't recognize.

Locking down admin access is good practice beyond this one flaw. Our privileged access management guidance covers how to limit who can reach admin consoles like this one.

This flaw is already on the Known Exploited Vulnerabilities (KEV) catalog (CISA). Federal agencies must remediate it by November 13, 2026. For a business like yours, the honest answer is now. Criminals are already using this flaw, not just researchers.

Log back in to the gateway's admin interface after updating. Open the firmware or version page again. Confirm it now reads 9.4.0.030 or later. Then review your configuration for any settings you didn't set yourself, since the flaw lets attackers restore a crafted backup file.

• Restrict the management interface to a virtual private network (VPN) or a short list of trusted addresses. This limits who can reach the login screen. It does not close the flaw itself.
• Turn on multi-factor authentication (MFA) everywhere else in your environment. This won't stop this specific bypass, but it limits damage if attackers pivot further.
• Watch the gateway's configuration and logs for unexpected changes. This buys you early warning, not prevention.
• Ask your provider to add the gateway to active monitoring. Our cybersecurity page outlines what that monitoring covers.

Do I need to worry if we only run one gateway appliance?

Yes. The flaw doesn't depend on how many appliances you run. A single exposed gateway is enough for an attacker to attempt the bypass.

Will updating break anything?

The record doesn't say. Test any update on a backup or staging appliance first, if you have one, and check the vendor's advisory for specific notes.

Does this affect other security software we run?

The record only names Barracuda Networks Barracuda Email Security Gateway (ESG). It doesn't say anything about other software, so check each vendor's own advisories separately.

What if we can't find our version number?

Contact your IT provider or the vendor's support channel for help locating it. If you handle regulated data, our FTC Safeguards Rule guidance explains why tracking this matters for compliance too.

Is this actually being exploited, or just theoretical?

It is being exploited. Its place on the Known Exploited Vulnerabilities (KEV) catalog (CISA) confirms real-world use, not just research.

LayerLogix brings 20+ years of experience and 100% U.S.-based support to businesses working through flaws like this one. If you want a second set of eyes on your email gateway and the rest of your network, start with a free IT assessment or contact our team directly.