{"id":"CVE-2026-116606","kind":"vulnerability","aliases":["CVE-2026-116606"],"related":[],"title":"Barracuda Email Security Gateway: authentication bypass lets attackers change global configuration","description":"An authentication bypass in Barracuda Email Security Gateway versions earlier than 9.4.0.030 allows an unauthenticated remote attacker to invoke a configuration-import function and restore a crafted, compatible backup archive, resulting in unauthorized modification of the appliance’s global configuration.","summary":"Barracuda Email Security Gateway versions earlier than 9.4.0.030 let an unauthenticated remote attacker call the configuration-import function. The attacker can restore a crafted backup archive and change the appliance's global configuration.","severity":"critical","cvss":9.3,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Email Security Gateway","fixed":["9.4.0.030"],"affected":"< 9.4.0.030","ecosystem":"vendor"}],"ecosystems":[],"tags":["appliance","barracuda","email-security-gateway","infrastructure","self-hosted"],"not_affected_if":["fixed-version"],"how_to_check":"Check the firmware version on the ESG admin interface (ADVANCED > Firmware Update / BASIC > Status); versions earlier than 9.4.0.030 are in NVD's affected range. Which interfaces expose the configuration-import function is not stated in any source; restrict the admin/management interface to trusted networks in the meantime.","fix":"Per NVD, versions earlier than 9.4.0.030 are affected; update ESG firmware to 9.4.0.030 or later (Barracuda's release notes list 9.4.0.030, but do not tie it to this CVE).","status":"open","published_at":"2026-11-02T13:17:37+00:00","first_seen_at":"2026-11-02T13:23:16+00:00","triaged_at":"2026-11-02T13:24:45+00:00","updated_at":"2026-11-02T13:25:51+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-02T13:24:45Z","model":"claude-haiku-5-5","output":{"fix":"- Barracuda Email Security Gateway: `9.4.0.030`","reach":"internet","title":"Barracuda Email Security Gateway: authentication bypass lets attackers change global configuration","impact":"high","summary":"Barracuda Email Security Gateway versions earlier than 9.4.0.030 let an unauthenticated remote attacker call the configuration-import function. The attacker can restore a crafted backup archive and change the appliance's global configuration.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["barracuda","email-security-gateway","appliance"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"unauthenticated attacker modifies the appliance's global configuration remotely","analyst_note":"Confirm which interfaces expose the configuration-import function and whether the NVD entry matches Barracuda's own advisory.","how_to_check":"- Check the installed firmware version on the Barracuda Email Security Gateway admin interface against the fixed version below.\n- unknown for other checks; the sources do not say.","plain_action":"","needs_analyst":true,"not_affected_if":["fixed-version"],"who_is_affected":"Organizations running Barracuda Email Security Gateway appliances earlier than 9.4.0.030 with the configuration-import function reachable over the network. The sources do not say which interfaces expose that function or whether any default configuration is affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.00068,"input_tokens":4128,"output_tokens":534,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Confirm which interfaces expose the configuration-import function and whether the NVD entry matches Barracuda's own advisory.","search":"'-116606':14A,17A '-2026':13A,16A '9.4.0.030':38B,76C 'allow':77C 'applianc':21B,61B,102C 'archiv':57B,95C 'attack':8A,43B,51B,81C 'authent':5A,66C 'backup':56B,94C 'barracuda':1A,22B,31B,69C 'bypass':6A,67C 'call':44B 'chang':9A,59B 'compat':93C 'configur':11A,47B,64B,86C,105C 'configuration-import':46B,85C 'craft':55B,92C 'cve':12A,15A 'earlier':36B,74C 'email':2A,18A,24B,32B,70C 'email-security-gateway':23B 'function':49B,88C 'gateway':4A,20A,26B,34B,72C 'global':10A,63B,104C 'host':30B 'import':48B,87C 'infrastructur':27B 'invok':83C 'let':7A,39B 'modif':99C 'remot':42B,80C 'restor':53B,90C 'result':96C 'secur':3A,25B,33B,71C 'security':19A 'self':29B 'self-host':28B 'unauthent':41B,79C 'unauthor':98C 'version':35B,73C","nicknames":[],"mitigations":[],"who_affected":"Organizations running Barracuda Email Security Gateway appliances earlier than 9.4.0.030 with the configuration-import function reachable over the network. The sources do not say which interfaces expose that function or whether any default configuration is affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":["emailsecuritygateway","securitygateway"],"ptokens":["email","gateway","security"],"labels":["appliance","barracuda","critical","emailsecuritygateway","infrastructure","selfhosted"],"first_public_at":"2026-11-02T13:17:37+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"mandiant-cve@google.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116606","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116606","severity":null,"published_at":"2026-11-02T13:17:37+00:00","modified_at":"2026-11-02T13:17:37+00:00","first_seen_at":"2026-11-02T13:23:16+00:00","fetched_at":"2026-11-02T13:23:16+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-116606:1370","url":null,"severity":null,"published_at":"2026-11-02T13:25:51+00:00","modified_at":"2026-11-02T13:25:51+00:00","first_seen_at":"2026-11-02T13:25:51+00:00","fetched_at":"2026-11-02T13:25:51+00:00","note":"Only NVD states this (fixed: 9.4.0.030). Barracuda's ESG release notes list 9.4.0.030 (Oct 30) but its entries (cluster quarantine, scp fix) do not mention this CVE or a config-import fix. No Barracuda advisory found; interfaces exposing config import unknown. Fix version is NVD-derived, not vendor-confirmed; nothing verified."}],"documents":[{"id":52068,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116606","title":"NVD CVE-2026-116606","kind":"advisory","source":"analyst","publisher":null,"text":"An authentication bypass in Barracuda Email Security Gateway versions earlier than 9.4.0.030 allows an unauthenticated remote attacker to invoke a configuration-import function and restore a crafted, compatible backup archive, resulting in unauthorized modification of the appliance's global configuration. CVSS 4.0 9.3 (mandiant-cve@google.com).","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":52069,"url":"https://documentation.campus.barracuda.com/wiki/spaces/BSFv51/pages/6684682/Release+Notes","title":"Barracuda ESG Release Notes (9.4.0.030 listed; no mention of this CVE)","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}