CVE-2026-116606: Configuration import / restore authorization check
Pre-authentication authorization bypass in Barracuda Email Security Gateway. Mandiant (CNA) says an unauthenticated remote attacker who can reach the admin interface can call the configuration-import function and restore a crafted backup, overwriting global configuration. Chained with CVE-2026-111560 this yields root on ESG. No exploitation reported as of Nov 3, 2026; not in CISA KEV.
Executive Summary & Technical Impact
Pre-authentication authorization bypass in Barracuda Email Security Gateway. Mandiant (CNA) says an unauthenticated remote attacker who can reach the admin interface can call the configuration-import function and restore a crafted backup, overwriting global configuration. Chained with CVE-2026-111560 this yields root on ESG. No exploitation reported as of Nov 3, 2026; not in CISA KEV.
Tracked under CVE-2026-116606 (CWE-288 (Authentication Bypass Using an Alternate Path or Channel)), this vulnerability affects All ESG versions (Barracuda); CNA record lists builds earlier than 9.4.0.030 and carries a severity score of 9.3 (CVSS 4.0, Mandiant CNA) (CRITICAL). Engineering and security operations teams running Email Security Gateway (ESG) should prioritize upgrading to ESG firmware 9.4.0.029+ (patches BNSF-40425 / BNSF-40430).
Remediation & Patch Guidance
- Upgrade ESG to firmware 9.4.0.029 or later and confirm under Advanced > Firmware Update.
- Apply BNSF-40425 (9.4.017+) or BNSF-40430 (older builds); appliances below 9.1 need a two-step upgrade.
- Restrict the ESG administrative interface to trusted networks; do not expose it to the internet.
- Review configuration integrity against a known-good backup for unexpected imports or policy changes.
Frequently Asked Questions (CVE-2026-116606)
What versions are affected by CVE-2026-116606?
CVE-2026-116606 affects All ESG versions (Barracuda); CNA record lists builds earlier than 9.4.0.030 in Email Security Gateway (ESG) (Configuration import / restore authorization check).
How do I patch or remediate CVE-2026-116606?
Upgrade affected deployments to ESG firmware 9.4.0.029+ (patches BNSF-40425 / BNSF-40430) and verify the remediation steps listed above.
What is the CVSS score of CVE-2026-116606?
CVE-2026-116606 is rated CRITICAL with a CVSS score of 9.3 (CVSS 4.0, Mandiant CNA) (vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N; requires reachability of the admin interface).
Barracuda ESG: A Pre-Auth Config Import Plus a Timezone Field Equals Root (CVE-2026-116606, CVE-2026-111560)
Barracuda has patched an authorization bypass in Email Security Gateway and a root command injection shared by six of its appliances. No exploitation is reported yet, but ESG has been an espionage target before.
Read full engineering post-mortem (5 min read) →