Barracuda ESG auth bypass, exploited in the wild (CVE-2026-116606) [PoC]

Actively exploited in the wild - CVE-2026-116606 is a critical authentication bypass in Barracuda Email Security Gateway versions earlier than 9.4.0.030 that lets an unauthenticated, remote attacker rewrite the appliance’s global configuration. Barracuda has shipped 9.4.0.030, so update immediately.

Overview

Barracuda Email Security Gateway is the mail gateway that filters inbound and outbound email for many organizations. Before version 9.4.0.030, the appliance exposed a configuration-import function that did not require authentication. An attacker who can reach that interface over the network can invoke it and restore a crafted backup archive that the appliance considers compatible. Restoring that archive replaces the device’s global configuration with whatever the attacker controls.

The CVSS score is 9.3, and every precondition favors the attacker: network reachable, low complexity, no privileges required, and no user interaction. There is no trick the victim has to fall for - the attacker only needs a path to the management interface.

Impact

Because the write lands at the global configuration level, the attacker is not limited to a single account. Depending on what the crafted archive contains, an intruder can alter mail-routing rules, rewrite filtering and delivery policy, change administrator credentials, or repoint the appliance at attacker-controlled infrastructure. On a mail gateway that often sits at the network edge, those changes can quietly redirect or copy email traffic. Treat any affected appliance that was reachable from the internet as potentially compromised at the configuration level, not merely misconfigured.

Remediation

• Update to Barracuda Email Security Gateway 9.4.0.030 or later. This is the primary fix; confirm the running version through the appliance console.
• Restrict access to the management interface to trusted administrative networks so that the import function is never reachable from the public internet.
• If the appliance was internet-facing before you patched, rotate administrator credentials, review global configuration against a known-good baseline, and audit mail-routing and filtering rules for changes you did not make.
• Monitor for log entries showing configuration import or restore activity from unexpected source addresses.

For context on how email-gateway compromises turn into data exposure, see our breach reports and the latest security news.

Security Insight

This is the third time Barracuda Email Security Gateway has landed in CISA KEV, echoing the 2023 zero-day wave that forced the vendor to replace physical appliances. The recurring theme is an internet-exposed management surface that turns a routine feature - here, archive import - into an unauthenticated write primitive. A vendor that keeps shipping administrative functions reachable without authentication should expect attackers to keep coming back to the same product line.

Further Reading

• All Critical Vulnerabilities
• Recent Critical Vulnerabilities
• Top Critical CVEs