Live › vulnerability › CVE-2026-116606
Barracuda Email Security Gateway versions earlier than 9.4.0.030 let an unauthenticated remote attacker call the configuration-import function. The attacker can restore a crafted backup archive and change the appliance's global configuration.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-02 13:23 UTC. All times on this page are UTC.
Organizations running Barracuda Email Security Gateway appliances earlier than 9.4.0.030 with the configuration-import function reachable over the network. The sources do not say which interfaces expose that function or whether any default configuration is affected.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Email Security Gateway | vendor | < 9.4.0.030 | 9.4.0.030 |
9.4.0.030 are in NVD's affected rangePer NVD, versions earlier than 9.4.0.030 are affected; update ESG firmware to 9.4.0.030 or later (Barracuda's release notes list 9.4.0.030, but do not tie it to this CVE).
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
An authentication bypass in Barracuda Email Security Gateway versions earlier than 9.4.0.030 allows an unauthenticated remote attacker to invoke a configuration-import function and restore a crafted, compatible backup archive, resulting in unauthorized modification of the appliance’s global configuration.
This page as .md · .json · in your agent: get_signal("CVE-2026-116606")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.