CVE-2026-116606
CriticalCVSS 9.3Summary
An authentication bypass in Barracuda Email Security Gateway versions earlier than 9.4.0.030 allows an unauthenticated remote attacker to invoke a configuration-import function and restore a crafted, compatible backup archive, resulting in unauthorized modification of the appliance's global configuration.
Risk Assessment
An unauthenticated attacker can alter the email gateway's global configuration, potentially weakening mail security policies and enabling further attacks. This poses a serious risk to the confidentiality and integrity of processed email.
Recommendation
Update Barracuda Email Security Gateway to version 9.4.0.030 or later. Restrict administrative access to the appliance to trusted networks.
Other vulnerabilities in Barracuda Email Security Gateway
Original NVD description (English source)
An authentication bypass in Barracuda Email Security Gateway versions earlier than 9.4.0.030 allows an unauthenticated remote attacker to invoke a configuration-import function and restore a crafted, compatible backup archive, resulting in unauthorized modification of the appliance’s global configuration.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS