CVE-2026-116606

Authentication Bypass Allows Global Configuration Restore in Barracuda Email Security Gateway

No known exploitation. No EPSS score yet. Fixed in 9.4.0.030.

CVSS —Not scored EPSS percentile—No score yet CISA KEVNot listedNo confirmed exploitation
No public exploit known Fix9.4.0.030Upgrade to this build

Check it yourself

No ready-made check. Neither Nuclei nor OpenVAS has one for this CVE yet.

Request a scan

Published 2026-11-02Updated 2026-11-03Sources: CVE.org, NVD

NVD CVE.org

What to do

Find your product and version, then upgrade to the build on the right.

Barracuda Networks Barracuda Email Security GatewayAffected: < 9.4.0.030Upgrade to: 9.4.0.030Stated by: CVE record

Versions as the sources state them. Full version matrix after sign-in

Steps

Written by AI from the record

Check which version of Barracuda Email Security Gateway (ESG) you are running (versions before 9.4.0.030 are affected).
If you manage the appliance yourself, schedule an update to version 9.4.0.030 or later.
If Barracuda manages your appliance (cloud/managed service), ask them to confirm the update has been applied.
After updating, review the gateway's configuration to confirm nothing was changed unexpectedly.

Usually a quick update

What it is

From the CVE record

An authentication bypass in Barracuda Email Security Gateway versions earlier than 9.4.0.030 allows an unauthenticated remote attacker to invoke a configuration-import function and restore a crafted, compatible backup archive, resulting in unauthorized modification of the appliance’s global configuration.

In plain language

Written by AI from the record

A flaw in Barracuda Email Security Gateway could let an outside attacker rewrite the appliance's settings without logging in, but there's no sign anyone is exploiting it yet, so act calmly and update soon.

An authentication bypass (CWE-288) in Barracuda Email Security Gateway allows an unauthenticated remote attacker to invoke the configuration-import function and restore a crafted backup archive, overwriting the appliance's global configuration.

If you're affected

Email security settings tampering
Mail flow disruption
Unauthorized device reconfiguration
Potential mail filtering bypass

What is it

Think of this like a mail-room security system that has a hidden back door someone could use to swap out its settings without ever showing ID. On Barracuda's email security appliance, that back door lets an outsider upload a fake 'backup' file and use it to change how the whole device is configured. No exploitation has been seen in the wild so far.

Who is affected

This matters to you if you run a Barracuda Email Security Gateway (ESG) appliance, whether on-premises or hosted, to filter your company's email. It affects the appliance directly rather than requiring any particular configuration to be reachable.

How urgent is it

There is no evidence of active exploitation and no public exploit code exists for this issue, so there is no need to treat this as an emergency. Barracuda has already published a fixed version, so the sensible move is to schedule the update during normal maintenance rather than scrambling.

What to do — in detail

Confirm exposure by checking the firmware/software version string in the ESG admin console; versions earlier than 9.4.0.030 are vulnerable to this CWE-288 authentication-bypass flaw in the configuration-import function. Upgrade to 9.4.0.030 or later via Barracuda's standard firmware update mechanism; review Barracuda's release notes for this version for any upgrade prerequisites or breaking changes. There is no documented temporary workaround from the findings, so prioritize applying the vendor-supplied update rather than relying on compensating controls. Not listed in CISA KEV and no CISA remediation due date applies. After updating, monitor the appliance's configuration-change audit log for any unexpected import/restore events predating the patch, and watch for vendor or researcher disclosures that could elevate exploitation status.

Technical context

Weakness: CWE-288 (Authentication Bypass Using an Alternate Path or Channel), exploited via an unauthenticated invocation of the configuration-import function to restore a crafted compatible backup archive and modify global appliance configuration. No public exploit code is on record and the CVE is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, indicating no confirmed active exploitation. Press attention is newly emerging but should not be read as evidence of in-the-wild attacks. Fixed in Barracuda ESG 9.4.0.030.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

CISA KEV: Not in the catalog. CISA has not confirmed exploitation.
Public exploits: No public exploit or proof of concept found in the sources we track.
EPSS: No EPSS score yet. New CVEs are usually scored within a few days.

Lifecycle

6 events over 1 day, from the signal feeds we watch.

2026-11-03Record updated
2026-11-02Publishedweakness classified, record updated, record updated, record updated

Affected products

Barracuda Networkscommercial · USaka barracuda spam firewall, rmm, barracuda im firewall
- Barracuda Email Security Gateway (ESG)On-premNetworking Infrastructure / firewall

Technical detail

Weaknesses

CWE-288No name in the record

Sources

References in the record

In the news

Watch the software you run.

My Stack ranks new CVEs for your products by real-world exploitation, so the next serious one reaches you without reading every advisory.

We'll flag the next CVE, public exploit or patch for Barracuda Networks, not every advisory.

A free account adds

The full version matrix and every affected product
Exploit links, proofs of concept and Metasploit modules
Email alerts for the products you watch
The same data over REST API, MCP and CLI

Create a free account