CVE-2026-116606
An authentication bypass in Barracuda Email Security Gateway versions earlier than 9.4.0.030 allows an unauthenticated remote attacker to invoke a configuration-import function and restore a crafted, compatible backup archive, resulting in unauthorized modification of the appliance’s global configuration.
Am I affected?
Sign in and add the software you use to your watchlist: we check it against every new vulnerability.
Show me how to fix itTimeline
- Published by NVD
- Last updated by NVD
- First covered by RedTeamDaily
Coverage
Barracuda discloses two flaws that could be chained for root access
Barracuda has disclosed a pre-authentication authorisation bypass and a command injection flaw affecting its products. Chained together, they could let an attacker bypass authorisation and gain root access to a susceptible device, and the article is tagged CVE-2026-116606 with a CVSS score of 9.3.
Sources: NVD and CISA known exploited vulnerabilities catalogue.