What is CVE-2026-116606 in Barracuda Email Security Gateway?
CVE-2026-116606 is a critical security vulnerability classified under vulnerabilidad crítica standards, affecting legacy deployments. For context regarding high-severity flaws, teams often review incidents like fallo crítico CVSS 9.3 to understand attack vectors.
An authentication bypass in Barracuda Email Security Gateway versions earlier than 9.4.0.030 allows an unauthenticated remote attacker to invoke a configuration-import function and restore a crafted, compatible backup archive, resulting in unauthorized modification of the appliance's global configuration according to the CVE-2026-112346 advisory style disclosures.
Who is affected and how severe is the risk?
Unauthenticated remote threat actors targeting network perimeters can leverage this vulnerability without needing prior system credentials. Security researchers from Mandiant documented the mechanics in their technical disclosures as referenced on.
The flaw receives a critical CVSS score of 9.3, utilizing the vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N, highlighting its severe impact on confidentiality, integrity, and availability.
How do I mitigate and protect my systems?
Administrators need to take immediate action to secure their appliances against potential exploitation of the configuration-import function. Reviewing official advisories via ensures compliance with vendor patches.
Follow these steps to properly secure your Barracuda infrastructure:
- Identify all deployed Barracuda Email Security Gateway instances running software versions older than 9.4.0.030.
- Access the administrator interface or management portal securely.
- Apply the vendor-provided firmware update to version 9.4.0.030 or higher immediately.
- Verify system logs to ensure no unauthorized configuration imports or backup restorations took place.