CVE-2026-116606

CVE Enrichment

CVSS: 9.3 CRITICAL
EPSS: 0.73%
EPSS Percentile: 54.23%
CISA KEV: Not listed

Description

An authentication bypass in Barracuda Email Security Gateway versions earlier than 9.4.0.030 allows an unauthenticated remote attacker to invoke a configuration-import function and restore a crafted, compatible backup archive, resulting in unauthorized modification of the appliance’s global configuration.

Technical Details

CVSS Version: 4.0
CNA / NVD Source: [email protected]
Published: 02-Nov-2026 20:17
Last Modified: 03-Nov-2026 12:18
EPSS Date: 2026-11-03
CWE: CWE-288

CVSS Vector


            CVSS:4.0                            AV:N /
                            AC:L /
                            AT:N /
                            PR:N /
                            UI:N /
                            VC:H /
                            VI:H /
                            VA:H /
                            SC:N /
                            SI:N /
                            SA:N /
                            E:X /
                            CR:X /
                            IR:X /
                            AR:X /
                            MAV:X /
                            MAC:X /
                            MAT:X /
                            MPR:X /
                            MUI:X /
                            MVC:X /
                            MVI:X /
                            MVA:X /
                            MSC:X /
                            MSI:X /
                            MSA:X /
                            S:X /
                            AU:X /
                            R:X /
                            V:X /
                            RE:X /
                            U:X

CNA Products / Version Status

Barracuda Networks · Barracuda Email Security Gateway (ESG) Source: CNA · [email protected]
Default status: unaffected

0 ≤ version < 9.4.0.030 — affected (custom)

References

Last enrichment sync: 04-Nov-2026 03:13
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (2)

bypass vulnerability and a command injection vulnerability, have been assigned the CVE identifiers CVE-2026-116606 (CVSS score: 9.3) and CVE-2026-111560 (CVSS score: 8.6), respectively. Barracuda Flaws Could Be Chained to Bypass Authorization and Gain Root Access
The first is a critical flaw (CVE-2026-116606) stemming from an Email Security Gateway (ESG) authentication weakness that attackers can exploit to modify an appliance's global configuration, while the second Barracuda Patches Two Flaws That Could Enable Root Access to Devices

CVE (3)

Malware (2)

Threat Actors (1)

MITRE ATT&CK (2)

Vendors (1)

Products (2)

Industries (1)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.