Loading vulnerability…
Authentication Bypass in Barracuda Email Security Gateway Configuration Import
CVE-2026-116606 is an authentication bypass affecting Barracuda Email Security Gateway versions earlier than 9.4.0.030. Incorrect control flow during an administrative password-change operation allows request processing to continue after an ERROR_PASSWD_CHANGE failure rather than terminating the request. This alternate path exposes a configuration-import function without requiring authentication. A remote attacker can restore a crafted, compatible backup archive and make unauthorized changes to the appliance's global configuration. The vulnerability has a CVSS v4.0 base score of 9.3.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation compromises appliance configuration integrity by allowing unauthenticated modification of global settings and bypass of administrative access controls. Unauthorized settings changes can undermine email-security policies and disrupt appliance operation. On appliances also vulnerable to CVE-2026-111560, an attacker can import a configuration containing a malicious timezone value and achieve operating-system command execution as root when that value is processed. Root-level compromise and potential interception or disruption of enterprise email are consequences of this vulnerability chain, not independently established capabilities of the authentication bypass alone.
If you can’t patch tonight, do this now.
Restrict access to the administrative interface to trusted internal networks and enforce appropriate network access controls. Remove direct internet exposure, particularly while awaiting remediation. Reenable automatic patching if it has been disabled and verify successful patch delivery. Management-interface restrictions reduce exposure but do not replace patching.
Patch, then assume compromise.
Upgrade Barracuda Email Security Gateway to firmware version 9.4.0.030 or later and verify that all applicable security patches have installed successfully. Barracuda also provides ESG security patches BNSF-40425 and BNSF-40430 for different firmware branches; apply the appropriate patch according to the vendor's product-specific instructions. Manually install updates if automatic delivery has not applied them. Substantially outdated appliances may require multiple sequential firmware updates.
1 exploit validated by Mallory's analysis.
105 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.