CVE-2026-116606
Critical9.3Barracuda Email Security Gateway (ESG): Authentication Bypass Allows Global Configuration Restore in Barracuda Email Security Gatewaytitle from the CVE record
An authentication bypass in Barracuda Email Security Gateway versions earlier than 9.4.0.030 allows an unauthenticated remote attacker to invoke a configuration-import function and restore a crafted, compatible backup archive, resulting in unauthorized modification of the appliance’s global configuration.
- CVSS
- 9.3v4.0
- EPSS (exploit probability)
- Unavailable
- CISA KEV
- Not listed
EPSS trendFIRST daily scores, last 90 days
Unavailable
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Learn
Why it happened and what stops it
The weakness (CWE)
How attackers use it (ATT&CK)
Typical for this kind of weakness across CISA KEV exploits (CTID), not specific to this CVE.
How it's exploited
What the attacker gets
Controls that mitigate it (NIST SP 800-53)
- AC-2Account ManagementAccess Control · mitigates 8 of these techniques
- AC-6Least PrivilegeAccess Control · mitigates 8 of these techniques
- CM-6Configuration SettingsConfiguration Management · mitigates 8 of these techniques
- SI-4System MonitoringSystem and Information Integrity · mitigates 8 of these techniques
- AC-3Access EnforcementAccess Control · mitigates 7 of these techniques
- AC-5Separation of DutiesAccess Control · mitigates 7 of these techniques
Coverage1 article
SANS Stormcast Tuesday, November 3rd, 2026: Multipath TCP (MPTCP) Detection; BTCPay Server 2.4.1 Hot Wallet Thefts; Barracuda ESG Flaws (CVE-2026-116606, CVE-2026-111560); Synology DSM Ransomware
Podcast6 minSANS Internet Storm Center StormCast3h agoVulnerabilitiesEndpointNetworkCVE-2026-111560CVE-2026-116606+1