A bank vault with a public door that lets anyone swap the guard's rulebook
CVE-2026-116606 affects Barracuda Email Security Gateway (ESG) versions earlier than 9.4.0.030. The appliance exposes a configuration-import function that should require administrator authentication, but an authentication bypass allows an unauthenticated remote attacker to reach it and restore a crafted, compatible backup archive. The appliance then applies the attacker-controlled global configuration, enabling unauthorized modification of mail security settings.
The vendor advisory describes a network-exploitable authentication bypass with high integrity and availability impact. Although no NVD CVSS baseline was available at assessment time, the CNA-assigned CVSS 4.0 vector is network/low-complexity/no-privileges/no-interaction with high host impact, and the product is a perimeter email-security choke point. In real-world terms, a successful restore can disable anti-spam/anti-malware policy, reroute mail flow, or create administrative access — so treating this as critical is appropriate for organizations that expose the management interface.
4 steps from start to impact.
Locate a reachable Barracuda ESG management interface
- Network access to the ESG management web interface (typically TCP/443 or 8443)
- Appliance firmware earlier than 9.4.0.030
- Many deployments restrict the admin interface to a management VLAN, so internet exposure is not guaranteed
- The attacker must first fingerprint the vulnerable version
Craft a compatible configuration backup archive
- Knowledge of Barracuda backup archive structure and encoding
- Ability to generate a file the appliance will parse and restore
- The backup archive format is not publicly documented in detail
- No public proof-of-concept or exploit code was indexed at assessment time
Invoke configuration import without authentication
- Vulnerable firmware earlier than 9.4.0.030
- Network path to the configuration-import function
- Access controls or a WAF in front of the admin interface may block the request, but the auth bypass itself is within the application
Appliance applies attacker-controlled global configuration
- A valid crafted archive accepted by the import function
- Configuration changes applied without requiring reboot or additional approval
- A visible service disruption or configuration change may alert administrators
- More consequential changes may require additional knowledge of Barracuda configuration semantics
- Enforcing MFA on admin logins does not help because the authentication bypass avoids the login flow entirely.
- SMTP-level or email-content filtering cannot stop the attack because it targets the management interface, not mail traffic.
- Generic antivirus or IPS signatures without CVE-specific rules will likely miss a crafted HTTPS configuration-import request.
The supporting signals.
| In-the-wild status | No known exploitation; not in CISA KEV and no source reports of active attacks as of 2026-11-02 |
|---|---|
| Proof-of-concept availability | No public exploit indexed in Metasploit, Exploit-DB, or public nuclei templates; no GitHub repos named after the CVE found in search results |
| EPSS score / percentile | Not yet scored or unavailable in the assessment window |
| KEV status | Not listed in CISA KEV |
| CVSS vector | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N — network, low complexity, no privileges, no interaction, high host confidentiality/integrity/availability impact |
| Affected versions | Barracuda Email Security Gateway earlier than 9.4.0.030 |
| Fixed version | 9.4.0.030 |
| Scanning / exposure data | No mass exploitation scanning data in the provided results; internet exposure of Barracuda ESG admin interfaces should be assessed with Shodan/Censys |
| Disclosure date | 2026-11-02 |
| CNA / reporter | CNA assigned by Mandiant; no individual reporter named in the available record |
Sources.
Why this verdict
- No NVD baseline exists — this is a first-party severity assessment, starting from the official description and the CNA CVSS 4.0 vector rather than an existing score.
- Unauthenticated remote attack: the vulnerable function requires no credentials, no user interaction, and no prior session; the bypass directly reaches a configuration-modification capability.
- Role multiplier: Barracuda ESG is a perimeter email-security appliance. A successful config restore can disable filtering, reroute mail, or add administrative access, giving an attacker org-wide mail-flow interference and a foothold in the security stack. This is a high-value role by definition, and the documented chain succeeds in that role.
- Friction is not enough to break the floor: management-interface exposure may be restricted in some deployments, but Barracuda ESG appliances have a history of internet-facing admin interfaces, and no exploitation exploit is required for severity — only for immediate likelihood.
Why not higher?
Not higher because there is no evidence of active exploitation or public exploit code as of 2026-11-02, and the attack requires crafting a compatible backup archive rather than a trivial HTTP request. Some organizations isolate the admin interface, which reduces the exposed population.
Why not lower?
Cannot reasonably go lower because the flaw is an unauthenticated path to modify the core security configuration of a perimeter mail gateway. The blast radius includes org-wide email security bypass and potential mail-flow interception, which satisfies the critical high-value-role floor.
Crowdsourced verification payload.
Run this from an auditor workstation with network access to the Barracuda ESG management interface. Invoke as python3 check_cve-2026-116606.py <host> [port], for example python3 check_cve-2026-116606.py esg1.example.com 443. No special privileges are required. The script performs a version fingerprint against the appliance and prints VULNERABLE, PATCHED, or UNKNOWN.
#!/usr/bin/env python3
import sys, re, ssl, urllib.request
def check(host, port=443):
url = f"https://{host}:{port}/"
ctx = ssl.create_default_context()
ctx.check_hostname = False
ctx.verify_mode = ssl.CERT_NONE
try:
req = urllib.request.Request(url, headers={'User-Agent':'Mozilla/5.0'})
with urllib.request.urlopen(req, timeout=10, context=ctx) as resp:
body = resp.read(200000).decode('utf-8', 'ignore')
headers = dict(resp.headers)
text = body[:500] + " " + " ".join(headers.values())
m = re.search(r'9\.4\.0\.(\d{3})', text)
if m:
patch = int(m.group(1))
return "VULNERABLE" if patch < 30 else "PATCHED"
m2 = re.search(r'(\d+)\.(\d+)\.(\d+)\.(\d+)', text)
if m2:
major, minor, patch, build = map(int, m2.groups())
if major < 9 or (major == 9 and (minor < 4 or (minor == 4 and patch == 0 and build < 30))):
return "VULNERABLE"
else:
return "PATCHED"
return "UNKNOWN"
except Exception as e:
return "UNKNOWN"
if __name__ == '__main__':
host = sys.argv[1] if len(sys.argv) > 1 else 'localhost'
port = int(sys.argv[2]) if len(sys.argv) > 2 else 443
print(check(host, port))