{"apiVersion":"1","notice":"Security Threat Pulse API v1. Free, no key. Facts with sources; verdicts follow the published rules at https://securitythreatpulse.com/methodology. Not advice. Some source data is withheld here until its terms allow re-serving.","generatedAt":"2026-11-11T08:30:38.905Z","products":["barracudanetworks"],"actNowTotal":2,"results":[{"query":"barracudanetworks","matched":2,"actNow":2,"events":[{"id":"kev-2026-11-10-barracuda-networks-barracuda-email-security-gatew","url":"https://securitythreatpulse.com/events/kev-2026-11-10-barracuda-networks-barracuda-email-security-gatew","title":"Barracuda Networks Barracuda Email Security Gateway (ESG): attackers can get in without a password","verdict":"act_now","verdictReason":"Attacks are confirmed. The vulnerability is 8 days old, so many systems are likely still unpatched. Ready-made attack tools are public. It affects a product that faces the internet or gives remote access. The severity score is critical (9.3).","tier":"today","rankScore":8,"rankWhy":["Exploitation is confirmed by an authoritative source.","The product faces the internet or gives remote access.","Ready-made attack tools are public.","The confirmation is 1 day old."],"rulesVersion":"v3","ladder":{"talk":"confirmed","damage":"none","attempts":"confirmed","exposure":"none","exploited":"confirmed"},"untrackedRungs":["exposure","damage"],"cves":["CVE-2026-116606"],"vendor":"Barracuda Networks","product":"Barracuda Email Security Gateway (ESG)","affectedProducts":[{"kind":"direct","slug":"barracudanetworks/barracudaemailsecuritygatewayesg","vendor":"Barracuda Networks","product":"Barracuda Email Security Gateway (ESG)","evidence":["kev","cpe"],"vendorKey":"barracudanetworks","productKey":"barracudaemailsecuritygatewayesg"}],"category":{"id":"edge","label":"VPN, firewall or gateway","why":"It sits at the edge of your network and faces the internet, so attackers can reach it directly.","doThis":"If you have it, patch it today. If you cannot, block access to it from the internet until you can."},"summary":"Barracuda Networks Email Security Gateway (ESG) contains an authentication bypass using an alternate path or channel that could allow an unauthenticated remote attacker to invoke a configuration-import function and restore a crafted, compatible backup archive, resulting in unauthorized modification of the appliance’s global configuration. This vulnerability can be chained with CVE-2026-111560.","cvss":9.3,"epss":0.01602,"exploitMaturity":"weaponized","kevListed":true,"kevDateAdded":"2026-11-10","kevDueDate":"2026-11-13","firstSeenAt":"2026-11-10T00:00:00.000Z","updatedAt":"2026-11-11T00:00:06.173Z","newestEvidenceAt":"2026-11-11T06:30:54.291Z"},{"id":"kev-2026-11-10-barracuda-networks-multiple-products","url":"https://securitythreatpulse.com/events/kev-2026-11-10-barracuda-networks-multiple-products","title":"Several Barracuda Networks products: attackers can run commands on it","verdict":"act_now","verdictReason":"Attacks are confirmed. The vulnerability is 8 days old, so many systems are likely still unpatched.","tier":"now","rankScore":6,"rankWhy":["Exploitation is confirmed by an authoritative source.","The confirmation is 1 day old.","7 products are affected."],"rulesVersion":"v3","ladder":{"talk":"confirmed","damage":"none","attempts":"confirmed","exposure":"none","exploited":"confirmed"},"untrackedRungs":["exposure","damage"],"cves":["CVE-2026-111560"],"vendor":"Barracuda Networks","product":"Multiple Products","affectedProducts":[{"kind":"direct","slug":"barracudanetworks/multipleproducts","vendor":"Barracuda Networks","product":"Multiple Products","evidence":["kev"],"vendorKey":"barracudanetworks","productKey":"multipleproducts"},{"kind":"direct","slug":"barracudanetworks/barracudaemailsecuritygatewayesg","vendor":"Barracuda Networks","product":"Barracuda Email Security Gateway (esg)","evidence":["cpe"],"vendorKey":"barracudanetworks","productKey":"barracudaemailsecuritygatewayesg"},{"kind":"direct","slug":"barracudanetworks/barracudaloadbalancerapplicationdeliverycontrolleradc","vendor":"Barracuda Networks","product":"Barracuda Load Balancer Application Delivery Controller (adc)","evidence":["cpe"],"vendorKey":"barracudanetworks","productKey":"barracudaloadbalancerapplicationdeliverycontrolleradc"},{"kind":"direct","slug":"barracudanetworks/barracudawebapplicationfirewallwaf","vendor":"Barracuda Networks","product":"Barracuda Web Application Firewall (waf)","evidence":["cpe"],"vendorKey":"barracudanetworks","productKey":"barracudawebapplicationfirewallwaf"},{"kind":"direct","slug":"barracudanetworks/barracudawebsecuritygatewaywsg","vendor":"Barracuda Networks","product":"Barracuda Web Security Gateway (wsg)","evidence":["cpe"],"vendorKey":"barracudanetworks","productKey":"barracudawebsecuritygatewaywsg"},{"kind":"direct","slug":"barracudanetworks/barracudamessagearchiverbma","vendor":"Barracuda Networks","product":"Barracuda Message Archiver (bma)","evidence":["cpe"],"vendorKey":"barracudanetworks","productKey":"barracudamessagearchiverbma"},{"kind":"direct","slug":"barracudanetworks/barracudawafcontrolcenterwcc","vendor":"Barracuda Networks","product":"Barracuda Waf Control Center (wcc)","evidence":["cpe"],"vendorKey":"barracudanetworks","productKey":"barracudawafcontrolcenterwcc"}],"category":{"id":"other","label":"Other software","why":"Software we have not put in a category yet. Your IT team or provider will know whether you run it.","doThis":"Find out if you use it. If you do, apply the vendor's fix."},"summary":"Barracuda Networks Email Security Gateway (ESG), Load Balancer, Application Delivery Controller (ADC), Message Archiver (BMA), WAF Control Center (WCC), Web Application Firewall (WAF), and Web Security Gateway (WSG) contain an OS command injection vulnerability.","cvss":8.6,"epss":0.0106,"exploitMaturity":"poc","kevListed":true,"kevDateAdded":"2026-11-10","kevDueDate":"2026-11-13","firstSeenAt":"2026-11-10T00:00:00.000Z","updatedAt":"2026-11-11T07:30:23.092Z","newestEvidenceAt":"2026-11-11T07:04:54.058Z"}]}]}