Barracuda Email Security Gateway Authentication Bypass (CVE-2026-116606)

Mandiant's CVE description says an unauthenticated remote attacker can invoke Barracuda Email Security Gateway's configuration-import function. That attacker can then restore a crafted, compatible backup archive. Restoring that archive changes the appliance's global configuration without any credentials.

Mandiant, the CNA that assigned the CVE, scores CVE-2026-116606 9.3 in CVSS 4.0, in disclosure MNDT-2026-0042. The vector is CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N.

Barracuda's own advisory lists the same 9.3 score and calls it High severity. No CVSS 3.1 score appears in the record or on NVD, where the CVSS panel still reads "N/A, NVD assessment not yet provided" as of 2 November 2026.

What Barracuda Warns About Chaining With CVE-2026-111560

Barracuda published CVE-2026-116606 together with a second flaw. The second flaw is a command injection in the timezone configuration field of several Barracuda appliances (CVE-2026-111560).

Barracuda's advisory says the two vulnerabilities, used in combination, could let an attacker bypass authorization controls and obtain root access to the device. CVE-2026-116606 supplies an entry point that needs no credentials. CVE-2026-111560 needs an authenticated administrator session; the configuration-import flaw could help an attacker reach it.

What the Record Does Not Say About the Crafted Backup

The record does not state how an attacker builds or obtains a "crafted, compatible" backup archive before restoring it. It also does not say whether a proof-of-concept exploit has been published.

What CISA KEV, Barracuda and Mandiant Say About Exploitation

These are the public signals we checked on 2 November 2026. Each one is listed below with what it currently shows.

A similar pattern hit FortiOS and FortiProxy's own authentication bypass, CVE-2024-55591. There, an attacker reached a websocket module to create an administrator session without credentials. Barracuda's flaw instead abuses a configuration-import function, but both let an unauthenticated attacker reach administrative control of a security appliance.

Barracuda ESG appliances carry an earlier, unrelated history of compromise: in 2023, a backdoor Brandefense calls SUBMARINE was found on ESG appliances. It was installed through a separate zero-day that Barracuda patched that year. That campaign and CVE-2026-116606 are different vulnerabilities on the same product line, disclosed three years apart.

Barracuda's advisory lists one affected product for CVE-2026-116606. The table below gives its affected and fixed versions.

Barracuda lists two patch identifiers for ESG. BNSF-40425 applies to appliances already on firmware 9.4.017 or later. BNSF-40430 applies to appliances on an earlier build.

Both patches also fix CVE-2026-111560, which affects five more Barracuda appliance products on top of ESG. Barracuda recommends restricting administrative interface access to trusted internal networks as an added control. It also recommends following its patch management guidance to track firmware updates across appliances on different release trains.