Search/CVE-2026-116606
● CVE

CVE-2026-116606

DiscoveredNov 2, 2026UpdatedNov 3, 2026

An authentication bypass in Barracuda Email Security Gateway versions earlier than 9.4.0.030 allows an unauthenticated remote attacker to invoke a configuration-import function and restore a crafted, compatible backup archive, resulting in unauthorized modification of the appliance’s global configuration.

View graph Watch Export
CVSS v3.1
—
EPSS
0.73%
probability of exploitation in 30 days
CISA KEV
Not listed
no confirmed exploitation reported
News coverage
5
sources referencing this CVE
Related IOCs
0
seen in the same coverage
Connections
7 relationships
Timeline
disclosure → media coverage
Nov 2, 2026
Disclosure — published as a CVE record.
Nov 3, 2026
bleepingcomputer.com reports: Barracuda warns of critical flaws allowing root access to devices
Nov 3, 2026
thehackernews.com reports: Barracuda Flaws Could Be Chained to Bypass Authorization and Gain Root Access
Nov 4, 2026
advisories.ncsc.nl reports: NCSC-2026-0465 [1.00] [M/H] Kwetsbaarheden verholpen in Barracuda Email Security Gateway
Nov 4, 2026
securityweek.com reports: Barracuda ESG Authentication Bypass Flaw Opens Path to Root
Nov 6, 2026
thehackernews.com reports: Experts Demonstrate Barracuda Email Security Gateway Chain Enabling Root Access Without Login
Public PoC (1)
github.com/watchtowrlabs/watchTowr-vs-Barracuda-RCE-CVE-2026-116606-CVE-2026-111560
Unverified third-party code — review before executing.