CVE-2026-116606: Authentication Bypass in Barracuda Email Gateway

CVE-2026-116606 describes an authentication bypass in Barracuda Email Security Gateway allowing an unauthenticated remote attacker to invoke the configuration import function and restore a crafted backup, unauthorizedly modifying the appliance's global configuration. The vulnerability affects all versions earlier than 9.4.0.030 and represents a critical risk for organizations relying on this email security solution, widely deployed in enterprise environments.

The vulnerability has a CVSS score of 9.3 and is rated as critical severity by official sources. In the security community, 6 posts on X have been reported in the last 24 hours, highlighting rapid awareness spread about the flaw. Currently, no public exploits are reported on GitHub repositories, however the potential impact is very high given the functional importance of the appliance.

Organizations must update immediately to version 9.4.0.030 or later. It is critical to review the appliance's access logs to detect unauthorized access attempts and unplanned configuration modifications. It is recommended to strengthen network controls by limiting access to the configuration import function to authorized administrative hosts only, and to enable continuous monitoring of configuration changes.