No VulnCrest analysis published for this CVE yet. Below is the original CNA/NVD description, unmodified.
Description
An authentication bypass in Barracuda Email Security Gateway versions earlier than 9.4.0.030 allows an unauthenticated remote attacker to invoke a configuration-import function and restore a crafted, compatible backup archive, resulting in unauthorized modification of the appliance’s global configuration.
Exploits & detection
Exploitwatchtowrlabs/watchTowr-vs-Barracuda-RCE-CVE-2026-116606-CVE-2026-111560 · github · ★ 4 · discovered
Unreviewed third-party code. Fake PoCs often contain malware — read the code before running it.
ExploitZeroHackOrg/barracuda-esg-zeroday-cve-2026-116606-analysis · github · ★ 1 · discovered
Unreviewed third-party code. Fake PoCs often contain malware — read the code before running it.
Detection templateBarracuda Email Security Gateway - Authentication Bypass · nuclei · discovered
In the news
- Experts Demonstrate Barracuda Email Security Gateway Chain Enabling Root Access Without LoginThe Hacker News · 06 Nov 2026
- Barracuda Flaws Could Be Chained to Bypass Authorization and Gain Root AccessThe Hacker News · 03 Nov 2026
Timeline
- Published: 02 Nov 2026
- Last modified upstream: 12 Nov 2026
- Added to CISA KEV: 10 Nov 2026
Sources & licenses
- CVE / CVSS / CWE
- NVD record ↗ (unmodified). This product uses the NVD API but is not endorsed or certified by the NVD. CVE® © The MITRE Corporation.
- Exploitation
- CISA KEV (CC0) · EPSS by FIRST.org
- References used for the analysis
- https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2026/MNDT-2026-0042.md (Third Party Advisory)
- https://trust.barracuda.com/security/pre-authentication-authorization-bypass-command-injection (Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-116606 (US Government Resource)
- Analysis, summary and remediation
- © VulnCrest