CVE-2026-116606 is a critical-severity vulnerability. An authentication bypass in Barracuda Email Security Gateway versions earlier than 9.4.0.030 allows an unauthenticated remote attacker to invoke a configuration-import function and restore a crafted, compatible backup archive, resulting in unauthorized modification of the appliance's global configuration.

This vulnerability affects Barracuda Email Security Gateway (ESG) versions earlier than 9.4.0.030.

ESG versions prior to 9.4.0.030 – (Affected)
ESG versions 9.4.0.030 and later – (Fixed)

This vulnerability does not require valid credentials. An attacker only needs network access to the ESG administrative interface. By exploiting the authorization bypass, an attacker can import a malicious backup configuration and modify system settings without authentication.

Step 1 - Identify a Reachable ESG Administrative Interface

The attacker identifies a vulnerable Barracuda Email Security Gateway administrative interface that is accessible from the internet or another reachable network.

Step 2 - Invoke the Configuration Import Function

The attacker accesses the configuration-import functionality without authentication by exploiting the authorization bypass vulnerability.

Step 3 - Upload a Crafted Backup Archive

The attacker uploads a specially crafted backup archive that is compatible with the appliance's configuration format.

Step 4 - Modify Global Configuration

The appliance restores the malicious backup, allowing the attacker to alter global configuration settings and potentially gain further control over the device.

CERTVU recommends the following:

1. Upgrade Immediately

   Upgrade Barracuda Email Security Gateway (ESG) to version 9.4.0.030 or later and apply all security updates released by Barracuda Networks.

2. Restrict Internet Exposure

   Prevent direct internet access to the ESG administrative interface and allow access only from trusted management networks and authorized IP addresses.

3. Deploy Network Filtering Controls

   Place ESG management interfaces behind firewalls and enforce strict access control policies to limit administrative access.

4. Monitor for Indicators of Compromise

   Review ESG audit logs and configuration change logs for unauthorized configuration imports, unexpected administrative actions, and suspicious access attempts.

5. Harden Administrative Access

   Replace default credentials where applicable, enforce strong authentication practices, and apply the principle of least privilege for administrator accounts.