Skip to content
NewA calmer, faster ZeroHour
Vulnerability1 · 1 read

CVE-2026-116606

Auth bypass in Barracuda Email Security Gateway before 9.4.0.030

CVSS 4.0
9.3 critical
EPSS
—
Published
·
Modified
Analyze CVE-2026-116606 with Vani AIImpact, affected versions, exploitation status, mitigations and detection
AI analysisSummaries by Vani AI

Barracuda Email Security Gateway versions earlier than 9.4.0.030 have an authentication bypass that lets unauthenticated remote attackers invoke a configuration-import function and restore a crafted backup archive. This allows unauthorized modification of the appliance’s global configuration. The flaw affects all prior versions of the product.

What to do: Upgrade Barracuda Email Security Gateway to 9.4.0.030.

ProductAffectedFixed in
Barracuda Email Security Gatewayearlier than 9.4.0.0309.4.0.030
Estimated exposure
No basis for an estimate.

Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.

Description · NVD

An authentication bypass in Barracuda Email Security Gateway versions earlier than 9.4.0.030 allows an unauthenticated remote attacker to invoke a configuration-import function and restore a crafted, compatible backup archive, resulting in unauthorized modification of the appliance’s global configuration.

Weakness
CWE-288
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD CVE.org GitHub PoCs EPSS (—)

In the news

4 stories