# CVE-2026-116606: Barracuda Email Security Gateway authentication bypass

Source: https://junglewise.ai/threats/cve-2026-116606-an-authentication-bypass-in-barracuda-email-security-gateway  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-02. Updated: 2026-11-02  
License: CC BY 4.0 with a link back

CVE-2026-116606 · Severity: critical · Exploited in the wild · Published 2026-11-02

Barracuda Email Security Gateway is an appliance that protects enterprise email from threats. An authentication bypass flaw allows remote attackers without credentials to import and restore a malicious backup file, enabling them to modify the gateway's configuration and potentially redirect, intercept, or disable email security protections.

Vendors: [Barracuda](https://junglewise.ai/threats/vendors/barracuda).

## Quick answers

**Is CVE-2026-116606 exploited in the wild?** Yes. CVE-2026-116606 is known to be exploited in the wild, first recorded on 10 November 2026. Treat it as urgent.

**How severe is CVE-2026-116606?** Critical severity, published 2 November 2026.

**Which products and versions are affected?** Barracuda Email Security Gateway earlier than 9.4.0.030.

**Is there a fix for CVE-2026-116606?** Yes: fixed in 9.4.0.030. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-116606 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-116606?** Check whether you run Barracuda Email Security Gateway or Barracuda Networks Barracuda Email Security Gateway (Esg) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 9.4.0.030

## Technical details

The vulnerability is an authentication bypass (CWE-288) in the configuration-import function that fails to validate credentials before allowing backup restore operations. An unauthenticated remote attacker can invoke this function over the network to restore a crafted backup archive, resulting in unauthorized modification of appliance global settings. The attack requires no user interaction, authentication, or special conditions.

## Affected products

- Barracuda Email Security Gateway earlier than 9.4.0.030

## Timeline

- 2026-10-22: disclosed: Reported by Barracuda
- 2026-11-02: advisory: CVE published and Mandiant advisory released

## References

- [https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2026/MNDT-2026-0042.md](https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2026/MNDT-2026-0042.md)
- [https://trust.barracuda.com/security/pre-authentication-authorization-bypass-command-injection](https://trust.barracuda.com/security/pre-authentication-authorization-bypass-command-injection)