CVE-2026-116606

Vulnerability Overview & Technical Description

Barracuda Networks Email Security Gateway (ESG) contains an authentication bypass using an alternate path or channel that could allow an unauthenticated remote attacker to invoke a configuration-import function and restore a crafted, compatible backup archive, resulting in unauthorized modification of the appliance’s global configuration. This vulnerability can be chained with CVE-2026-111560.

Common Weakness Enumeration (CWE)

Official Vendor Advisories & Technical Bulletins

• NIST NVD Advisory
• MITRE CVE Record
• Advisory (trust.barracuda.com)
• Advisory (github.com)
• Advisory (cisa.gov)
• Advisory (cisa.gov)