CRITICAL 9.3 NVD
CVE-2026-116606
An authentication bypass in Barracuda Email Security Gateway versions earlier than 9.4.0.030 allows an unauthenticated remote attacker to invoke a configuration
An authentication bypass in Barracuda Email Security Gateway versions earlier than 9.4.0.030 allows an unauthenticated remote attacker to invoke a configuration-import function and restore a crafted, compatible backup archive, resulting in unauthorized modification of the appliance’s global configuration.
References
- https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2026/MNDT-2026-0042.md
- https://trust.barracuda.com/security/pre-authentication-authorization-bypass-command-injec
This critical severity vulnerability with a CVSS score of 9.3 was published on 2026-11-02 via NVD.
Risk Timeline
CVE Disclosed2026-11-02 · -1 days ago
Remediation Resources
vulnfeed aggregates 17991 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.