Barracuda Email Security Gateway: critical auth bypass allows config takeover

What happened

On 2 November 2026, a critical vulnerability in Barracuda Email Security Gateway was made public, tracked as CVE-2026-116606 with a CVSS base score of 9.3. It was reported via a Mandiant vulnerability disclosure, and Barracuda has published an advisory.

The flaw is an authentication bypass. An unauthenticated remote attacker can call the appliance's configuration-import function and restore a crafted, compatible backup archive. The result is an unauthorized change of the appliance's global configuration. News reports describe that this flaw can be chained with further issues to gain root access to the device; Barracuda's advisory linked below covers the details.

At the time of writing there are no confirmed reports of active exploitation. Barracuda email gateways have been targeted by attackers in the past, so a quick update is advisable.

Who is affected

• Barracuda Email Security Gateway in all versions earlier than 9.4.0.030.
• The risk is highest for appliances whose management interface is reachable from the internet or from untrusted networks.

An attacker who controls the configuration of a mail gateway can, for example, redirect or intercept mail flows, weaken filtering or create access for later attacks. This affects every mail domain routed through the appliance, including those of your customers.

What to do now

1. Check the firmware version of each Barracuda Email Security Gateway in its web interface.
2. Export a current configuration backup and store it outside the appliance.
3. Update every appliance to version 9.4.0.030 or later, following the Barracuda advisory linked below.
4. After the update, confirm the new version is shown and that mail is being received, filtered and delivered normally.
5. Restrict access to the management interface to trusted administrative networks or a VPN, if it is currently reachable from the internet.
6. Review the global configuration for changes you did not make (see below). If you find any, treat the appliance as compromised, restore a known good configuration, change administrator passwords and API credentials, and contact Barracuda support.

How to check whether you are affected

• Any appliance running a version below 9.4.0.030 is vulnerable.
• Compare the current configuration with your last known good backup. Pay attention to mail routing and relay settings, delivery destinations, filtering and allow lists, administrator accounts and remote access settings.
• Review the appliance's audit and access logs for configuration imports or restores that were not performed by your team, especially since the disclosure on 2 November 2026.
• If the management interface was exposed to the internet, check for unexpected logins or requests from unknown IP addresses.

Sources

• https://nvd.nist.gov/vuln/detail/CVE-2026-116606
• https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2026/MNDT-2026-0042.md