External risk intelligence

Barracuda ESG Authentication Bypass Allows Global Configuration Import

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-116606

The vulnerability affects an Email Security Gateway, which is an appliance designed by nature to sit at the network perimeter to filter inbound traffic. As an internet-facing gateway product intended to receive external connections, it represents a service that is public-facing by design in normal deployment.

Authentication Bypass

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This critical vulnerability affects Barracuda Email Security Gateways, allowing an unauthenticated remote attacker to bypass security controls and alter the device's configuration by importing a crafted backup. This could enable unauthorized changes to the gateway's settings, potentially impacting its security posture and operational integrity.

Attacker can change gateway settings without login.
A critical perimeter device is compromised.
Confirm exposure and impact on our network.

Attack Path

How an attacker could exploit the issue

An attacker could bypass authentication on a Barracuda Email Security Gateway to import a crafted backup archive. This action would allow them to alter the appliance's global settings without authorization.

No authentication required.
Triggered by importing a crafted backup.
Leads to unauthorized configuration changes.

Live Threat

Current exploitation, exposure, and threat context

An unauthenticated remote attacker could bypass authentication to import a crafted backup archive, potentially modifying the appliance's global configuration. This could affect the security and operational integrity of the email gateway.

Appliance global configuration.
Remote unauthenticated import of crafted archive.
Unauthorized configuration changes.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical vulnerability affects Barracuda Email Security Gateways, posing a significant risk due to an unauthenticated remote attacker's ability to bypass authentication and modify the appliance's global configuration. Identifying all instances of the affected technology, confirming their reachability and business criticality, and then assigning an accountable owner are the crucial first steps before planning remediation.

Ownership: Infrastructure or appliance management teams.
Verify: Appliance reachability and business criticality.
Action: Plan coordinated remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Barracuda Email Security Gateway?

This is a specialized network appliance used by organizations to protect email systems. It acts as a gatekeeper, scanning incoming and outgoing traffic for spam, viruses, and phishing threats before they reach the internal network. Because it sits at the network perimeter, it is designed to interact directly with internet traffic to perform its filtering duties.

What does CVE-2026-116606 mean for system security?

This CVE represents an authentication bypass, categorized as CWE-288. In plain terms, it means the security controls that normally require a password or login can be skipped. Because of this weakness, an attacker could interact with the device as if they were an authorized administrator, specifically gaining the ability to import and apply new configuration files to the system.

How is this authentication bypass triggered?

The flaw is triggered when an attacker sends a crafted, compatible backup archive to the gateway's configuration-import function. The system processes this file without verifying if the request came from a legitimate user. It is important to note that the vulnerability does not require the attacker to have existing credentials; the act of importing the malicious archive is the exploit path itself.

Is my Barracuda gateway at risk?

According to Halo Surface Signal, this vulnerability is particularly relevant because these gateways are public-facing by design to intercept email. Any instance of the affected appliance that is connected to the internet to perform its filtering functions is considered to have a high-risk profile for this type of remote, unauthenticated access attempt.

What should I do if I manage these appliances?

The first step is to identify all Barracuda Email Security Gateways in your environment and determine which are running versions earlier than 9.4.0.030. Once identified, verify their reachability and business criticality. Coordinate with your infrastructure or appliance management teams to plan for an update to a secure version, as this is the only way to resolve the vulnerability.

References

github.com/mandiant/Vulnerability-Disclosures/blob/master/2026/M…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.