CVE-2026-116606 Barracuda Networks Barracuda Email Security…
An authentication bypass in Barracuda Email Security Gateway versions earlier than 9.4.0.030 allows an unauthenticated remote attacker to invoke a configuration-import function and restore a crafted, compatible backup archive, resulting in unauthorized…
- CVSS
- 9.3 Critical
- EPSS
- 8.9%
- Percentile
- 95
- Published
- 2026-11-02
- Force
- 11 of 12
- Public PoC
- 1
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
On CISA’s exploited list
Barracuda Networks Email Security Gateway (ESG) Authentication Bypass Using an Alternate Path or Channel Vulnerability
- Added
- 2026-11-10
- Federal patch deadline
- 2026-11-13
- Ransomware use
- not known