CVE-2026-116606

An authentication bypass in Barracuda Email Security Gateway versions earlier than 9.4.0.030 allows an unauthenticated remote attacker to invoke a configuration-import function and restore a crafted, compatible backup archive, resulting in unauthorized modification of the appliance’s global configuration.

CVSS

9.3

EPSS

0.007 (54.3th percentile)

CISA KEV

Not listed

Exploitation

none

Public exploits

None seen

State

PUBLISHED

Coverage

• 

  watchTowr Labs◆Authoritative. Authoritative publisher: a primary source, or a newsroom with formal editorial standards2 hours ago

  Barracuda Networks is your new best friend (Barracuda Email Security Gateway Pre-Auth Remote Root RCE CVE-2026-116606 / CVE-2026-111560)

  Yes, that's right! Today we're at the aquarium. Welcome back to yet another watchTowr Labs blog post. You can begin preparing your comments now. What Is A Barracuda, And Why? Must We? Barracuda’s Email Security Gateway solution (ESG) is no stranger to love, for

  ↗labs.watchtowr.com/barracuda-networks-is-your-n…(opens the publisher's site in a new tab)

What we observed