CVE-2026-116606: Authentication Bypass Allows Global Configuration Restore in Barracuda Email Security Gateway

Analysis on rafaelpfister.ch

Article · November 11, 2026 CVE-2026-116606: Barracuda ESG Authentication Bypass Is Being Exploited - Update and Check for Compromise An authentication bypass in Barracuda Email Security Gateway before 9.4.0.030 (CVE-2026-116606, CVSS 4.0: 9.3) allows a crafted configuration backup to be imported without logging in. Barracuda confirms attacks, and CISA has listed the vulnerability in its KEV Catalog since November 10, 2026. Patches have been available since November 2; the management interface should not be accessible from the internet.

Vendor description

An authentication bypass in Barracuda Email Security Gateway versions earlier than 9.4.0.030 allows an unauthenticated remote attacker to invoke a configuration-import function and restore a crafted, compatible backup archive, resulting in unauthorized modification of the appliance’s global configuration.

Reference data

Vendor

Barracuda Networks

Affected products

Barracuda Email Security Gateway (ESG)

CVSS 4.0

9.3 (CRITICAL)

Vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Weakness type

CWE-288: Authentication bypass using an alternate path or channel

Published

November 2, 2026

In KEV catalog since

November 10, 2026

US federal deadline

November 13, 2026

Official sources

← All vulnerabilities