Skip to main content
Apexward Pulse

Barracuda Networks · Auth bypass

Barracuda Networks Email Security Gateway (ESG) Authentication Bypass Using an Alternate Path or Channel Vulnerability

CVE-2026-116606

What this means

This is rated critical severity (9.3 out of 10). It is on the known-exploited catalogue, which means attacks using it have already been seen. Ask IT whether Barracuda Networks Barracuda Email Security Gateway (ESG) is in your estate, and treat that as the priority.

Full vendor description

An authentication bypass in Barracuda Email Security Gateway versions earlier than 9.4.0.030 allows an unauthenticated remote attacker to invoke a configuration-import function and restore a crafted, compatible backup archive, resulting in unauthorized modification of the appliance’s global configuration.

Scoring and exploitation

9.3/ 10
CVSS 4.0 base scoreCritical

Exploitable over the network without any account, and no one has to click or open anything. High impact on confidentiality, integrity and availability.

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Exploitability

Longer bar: easier to attack

Attack vectorNetworkAV:N
Attack complexityLowAC:L
Attack requirementsNoneAT:N
Privileges requiredNonePR:N
User interactionNoneUI:N

Impact

Longer bar: more harm

ConfidentialityHighVC:H
IntegrityHighVI:H
AvailabilityHighVA:H
~1.6% estimated chance of attack in 30 daysModel estimate (): a probability signal, not confirmed exploitation
Exploited in the wild
Yes — confirmed exploitation (US CISA )
Not reported
Listed product
Barracuda Networks Barracuda Email Security Gateway (ESG)

Weaknesses

CWE-288

References

3 links from the CVE record, grouped by site.

Related feed events