Release Notes - October 13, 2026

BarracudaONE displays this risk when it detects, through Barracuda Email Gateway Defense, that one or more commonly abused email domains are included in allow-list policies. This configuration bypasses email filtering controls and exposes your organization to impersonation attempts, domain spoofing, malware delivery, and unwanted email.

The included domains are:

• Intuit.com

• Docusign.net

• Adobesign.net

• Amazon.com

• Dropbox.com

• Mailchimp.com

• Microsoft.com

• NetSuite.com

• QuickBooks.com

• sf-notifications.com

• SharePointOnline.com

• UKG.com

• Zoom.com

For more information, see Understanding the Risky allow-list policies detected risk.

The addition of Identity risks expands BarracudaONE’s Risk report by integrating insights from Microsoft Entra ID to give you clear visibility into your organization’s identity attack surface. This update highlights critical gaps—such as multi-factor authentication (MFA) coverage, privileged account controls, global admin counts, and inactive or unmanaged access—alongside an overall identity security level. By combining these findings with potential impact analyses and prioritized remediation steps, the report lets administrators quickly identify identity vulnerabilities, safeguard essential business assets, and take targeted action to reduce organizational risk.

For more information, see Generating and exporting Risks reports.

To better protect your API credentials, an app's client secret is now displayed only once: when the app is created or when you generate a new secret. Copy it at that time and store it securely; it can't be viewed again. The API reference page no longer fills in the client secret; paste it in yourself, or generate a new one from the app's page.

As a security precaution, generate a new client secret for each of your existing API Portal apps.

1. In BarracudaONE, navigate to Settings > API Portal > Apps & credentials.

2. Click each app to open it.

3. Click Generate new secret.

The previous secret stops working immediately, so update any integrations that use it with the new secret.

For more information, see Creating apps with the BarracudaONE API.