CVE-2026-116606: Critical severity vulnerability
An authentication bypass in Barracuda Email Security Gateway versions earlier than 9.4.0.030 allows an unauthenticated remote attacker to invoke a configuration-import function and restore a crafted, compatible backup archive, resulting in unauthorized modification of the appliance’s global configuration.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Barracuda Email Security Gatewayto a version that resolves this vulnerability.Fixed in 9.4.0.030
Event History
Frequently Asked Questions
Which deployments are affected?
Barracuda Email Security Gateway appliances running versions earlier than 9.4.0.030 are affected.
What does an attacker need to exploit this issue?
The vulnerability can be exploited remotely without authentication, user interaction, or prior privileges. The attacker needs to invoke the configuration-import function and provide a crafted, compatible backup archive.
What is the impact of successful exploitation?
A successful exploit allows unauthorized modification of the appliance's global configuration through restoration of the crafted backup archive.
What version addresses the issue?
The issue affects versions earlier than 9.4.0.030; upgrading to 9.4.0.030 or later removes the identified affected version range.