# CVE-2026-116606: Authentication Bypass Allows Global Configuration Restore in Barracuda Email Security Gateway

Status: published. Published: 2026-11-02. Updated: 2026-11-02.

An authentication bypass in Barracuda Email Security Gateway versions earlier than 9.4.0.030 allows an unauthenticated remote attacker to invoke a configuration-import function and restore a crafted, compatible backup archive, resulting in unauthorized modification of the appliance’s global configuration.

## Remediation

No remediation reported in collected sources

## Affected products and versions

- Barracuda Networks / Barracuda Email Security Gateway (ESG): ≥ 0; < 9.4.0.030 (affected, custom). Source: CNA: Mandiant

## Severity and prioritization

- CVSS 4.0: 9.3 (critical); CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N; source: CNA: Mandiant

- CISA KEV: No listing in collected sources

- EPSS: Not available

- SSVC: Not available

- Weaknesses: CWE-288

## Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

## References

- https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2026/MNDT-2026-0042.md (CNA: Mandiant; third-party-advisory)

- https://trust.barracuda.com/security/pre-authentication-authorization-bypass-command-injection (CNA: Mandiant; vendor-advisory)

## Provenance

- CNA: Mandiant: https://www.cve.org/CVERecord?id=CVE-2026-116606; retrieved 2026-11-02; source updated 2026-11-02

Revision: 0b1964e2fe32ec0e9a19d45ac878ba6f2101035f3d1e265927027e88a99bcbd8

Canonical: https://y2.dev/cve/CVE-2026-116606