CVE-2026-116606: Authentication Bypass in Barracuda Email Security Gateway
This text was generated using artificial intelligence (AI).CVE-2026-116606 affects the Barracuda Email Security Gateway in versions prior to 9.4.0.030. The vulnerability allows an unauthenticated attacker to invoke a configuration import function over the network. A crafted, compatible backup archive can be restored, which allows unauthorized modification of the appliance's global configuration.
The vulnerability is classified as an authentication bypass via an alternate path or channel (CWE-288). The attack can occur over the network, requires no privileges, and no user interaction.
The affected function imports configurations. If the login bypass is successful, an attacker can restore a compatible, crafted backup archive. The documented consequence is unauthorized alteration of the appliance's global configuration. Barracuda Networks internally refers to the vulnerability as Pre-Authentication Authorization Bypass and Command Injection; the full scope of the attack can be found in the Barracuda advisory.
Mandiant publishes the identifier MNDT-2026-0042. Barracuda Networks provides a fix for affected installations in version 9.4.0.030.
Measures for Affected Systems
For Barracuda Email Security Gateway appliances prior to version 9.4.0.030, the following measures apply:
Check for affected status and patch status. Identify which deployed appliances are using a version prior to 9.4.0.030.
Perform upgrade. Update affected systems to version 9.4.0.030 or higher.
Limit management access. Do not make the management interface publicly accessible and restrict access to predefined IP addresses.
Prioritize affected systems. Give precedence to systems with the affected software version in processing.
Establish monitoring. Continuously conduct vulnerability and vendor risk monitoring.
NIS-2 obligated organizations in Germany and Austria operating Barracuda ESG appliances should document the impact assessment and initiated measures. In Switzerland, the revised Information Security Act (ISG) applies, imposing a reporting obligation to BACS. If personal data is compromised through an exploited vulnerability, the 72-hour reporting obligation under GDPR Art. 33 to the responsible supervisory authority also applies.
Classify externally accessible ESG appliances
Barracuda Email Security Gateway appliances can be operated within a company's infrastructure and be externally accessible. External Attack Surface Management helps identify externally reachable ESG appliances as assets and include them in technical prioritization.
LocateRisk makes externally reachable systems and deployed software visible. This allows checking which ESG appliances are accessible under your own domain or infrastructure. The actual impact from CVE-2026-116606 depends on the installed software version and requires an assessment of the respective appliance.
For this vulnerability, the combination of an externally reachable appliance, the affected software version, and a publicly accessible management interface is relevant. The technical processing, therefore, includes checking the patch status, upgrading to the fixed version, and restricting management access.
Am I affected?
This affects Barracuda Networks in the versions mentioned above; the vulnerability was fixed in 9.4.0.030. If you want to know whether Barracuda Networks is visible in your externally accessible infrastructure at all, you can use the CVE Quick Check Use the tool at the end of this article: It shows exposed systems and the software that is visible from the outside.
It is not always possible to determine the specific version that has been installed from the outside—the key factor is comparing it with the manufacturer's advisory.
An unauthenticated attacker can call a configuration import function and restore a crafted, compatible backup archive. This can lead to unauthorized changes to the global configuration of the appliance.
There is no documented active exploitation for CVE-2026-116606.
As of November 02, 2026. This article is for general informational purposes and is not legal, security, or action advice for individual cases. The IT security situation and patch availability may have changed since publication; the linked vendor advisory is always authoritative. Despite careful research, we do not guarantee the timeliness, accuracy, and completeness.
CVE Quick Check
In just a few minutes, check whether there are any indications of a current CVE on your externally visible attack surface.
Initial assessment in just a few minutes via email.
Learn more during a free consultation with a LocateRisk consultant.
You'll receive this by email
companyYour Company, LLC
Verified CVECVE-2026-116606
Passive Assessment
Information About the CVEfound or not found
Want to find out more, book a demo or simply exchange ideas? We look forward to hearing from you!
We use cookies to optimize our website and our service.
Functional
Always active
Technical storage or access is strictly necessary for the lawful purpose of enabling the use of a particular service expressly requested by the subscriber or user, or for the sole purpose of carrying out the transmission of a message over an electronic communications network.
Preferences
The technical storage or access is necessary for the legitimate purpose of storing preferences that have not been requested by the subscriber or user.
Statistics
The technical storage or access, which is carried out exclusively for statistical purposes.Technical storage or access used solely for anonymous statistical purposes. Without a subpoena, the voluntary consent of your Internet service provider, or additional records from third parties, information stored or accessed for this purpose alone generally cannot be used to identify you.
Marketing
Technical storage or access is necessary to create user profiles, to send advertisements, or to track the user on a website or across multiple websites for similar marketing purposes.
English 
Deutsch 
Français