An authentication bypass in Barracuda Email Security Gateway versions earlier than 9.4.0.030 allows an unauthenticated remote attacker to invoke a configuration-import function and restore a crafted, compatible backup archive, resulting in unauthorized modification of the appliance’s global configuration.
| CVE | CVE-2026-116606 |
|---|---|
| Severidad | CRITICAL |
| EPSS | 1.6% en 30 días (percentil 76) |
| CWE | CWE-288 |
| CISA KEV | Explotación activa confirmada |
| Exposición (Shodan) | sin hosts expuestos detectados actualmente |
| PoC público | github.com, github.com |