Read the docs
TI-2026-83805 Aliases CVE-2026-116606GHSA-9fcr-mp7p-hprv

Authentication bypass in Barracuda Email Security Gateway allows config restore

Priority MEDIUM 49CWE-288Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-288.

Summary

Barracuda Email Security Gateway versions before 9.4.0.030 contain an authentication bypass caused by an alternate path (CWE-288). An unauthenticated remote attacker can invoke a configuration-import function and restore a crafted, compatible backup archive, which modifies the appliance's global configuration without authorization.

Written with Claude Haiku 5.5 from the sources below · 2026-11-02

Description from the CNA

An authentication bypass in Barracuda Email Security Gateway versions earlier than 9.4.0.030 allows an unauthenticated remote attacker to invoke a configuration-import function and restore a crafted, compatible backup archive, resulting in unauthorized modification of the appliance’s global configuration.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00728 54th percentileScored 2026-11-07
Fix Fixed Barracuda Email Security Gateway (ESG) (Barracuda Networks): 9.4.0.030

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Barracuda NetworksBarracuda Email Security Gateway (ESG)before 9.4.0.0309.4.0.030Patch availableCNA
  • Barracuda Email Security Gateway (ESG) VendorBarracuda Networks Affected before 9.4.0.030 Fixed in 9.4.0.030 Patch available CNA

Remediation

Upgrade Barracuda Email Security Gateway to version 9.4.0.030.

Written with Claude Haiku 5.5 from the sources below · 2026-11-02

  • Fix · CNA Barracuda Email Security Gateway (ESG) (Barracuda Networks) Fixed in 9.4.0.030

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    Barracuda Email Security Gateway (ESG) — trust.barracuda.com/security/pre-authentication-authorizati…

    2 records Highest priority Priority MEDIUM 2 MEDIUM

    Other records, highest priority first

    • TI-2026-83801 OS command injection in Barracuda appliancesPriority MEDIUM 40
    Show all 2 records → Advisory →

Timeline

  1. 2026-11-02 Threatist record created from CVE-2026-116606
  2. 2026-11-02 Alias added: GHSA-9fcr-mp7p-hprv
  3. 2026-11-02 CISA SSVC decision points changed
  4. 2026-11-03 CISA SSVC decision points changed

References

Advisory 2

  • TI-2023-02687 Remote Code injection in Barracuda Email Security Gateway KEVCVSS 3.1CRITICAL 9.8
  • TI-2025-24469 Barracuda RMM < 2025.1.1 Service Center Absolute Path Traversal RCE CVSS 4.0CRITICAL 10.0
  • TI-2010-05064 Barracuda Spam & Virus Firewall "locale" Path Traversal CVSS 4.0HIGH 8.7
  • TI-2023-06497 Remote code execution (RCE) in Barracuda ESG Appliance CVSS 3.1CRITICAL 9.8
  • TI-2005-02695 img.pl in Barracuda Spam Firewall running firmware 3.1.16 and 3.1.17 allows remote… CVSS 2.0HIGH 7.5
  • TI-2025-24471 Barracuda RMM < 2025.1.1 Service Center .NET Remoting Deserialization RCE CVSS 4.0CRITICAL 10.0
See all 22 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences