Barracuda Networks Email Security Gateway (ESG) Authentication Bypass Using an Alternate Path or Channel Vulnerability

Publisher's required action

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

This wording is attributed to the CISA snapshot. Verify current vendor guidance, affected versions and your deployment before applying changes.

Keep the signals separate.

Ransomware use, as reported by CISA

Unknown

CVSS severity

Not supplied by KEV

EPSS probability

Not available

No EPSS value was supplied for this record in the current snapshot. Unknown values are not treated as zero.

“Unknown” ransomware use is an unknown source field, not proof that ransomware activity has not occurred.

Source notes

https://trust.barracuda.com/security/pre-authentication-authorization-bypass-command-injection ; https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2026/MNDT-2026-0042.md ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-116606

Source & freshness

Automated source record, not an editorial advisory or an independent discovery. No affected or fixed version is inferred, and no organisation-specific risk rating is generated.