CVE-2026-116606
Barracuda Networks Email Security Gateway (ESG) Authentication Bypass Using an Alternate Path or Channel Vulnerability
What is it?
An authentication bypass in Barracuda Email Security Gateway versions earlier than 9.4.0.030 allows an unauthenticated remote attacker to invoke a configuration-import function and restore a crafted, compatible backup archive, resulting in unauthorized modification of the appliance’s global configuration.
Official description from NVD.
What happened
Two vulnerabilities in Barracuda's Email Security Gateway can be chained to grant unauthenticated attackers root-level command execution. CVE-2026-116606, an authorization bypass, allows unauthorized access without login. Barracuda released patches Monday; watchTowr disclosed full attack details Thursday. Organizations running the appliance should apply patches immediately to prevent remote compromise.
From the Intel60 brief of Nov 6, 2026. AI-written summary: check the sources before acting.
Intel60 briefs
- CriticalBarracuda Email Security Gateway chained flaws enable root accessNov 6, 2026