Barracuda Email Security Gateway - Authentication Bypass
An authentication bypass in Barracuda Email Security Gateway versions earlier than 9.4.0.030 allows an unauthenticated remote attacker to invoke a configuration-import function and restore a crafted, compatible backup archive, resulting in unauthorized modification of the appliance's global configuration. References: https://labs.watchtowr.com/barracuda-networks-is-your-new-best-friend-barracuda-email-security-gateway-pre-auth-remote-root-rce-cve-2026-116606-cve-2026-111560/ https://github.com/watchtowrlabs/watchTowr-vs-Barracuda-RCE-CVE-2026-116606-CVE-2026-111560 https://blog.ostorlab.co/barracuda-esg-pre-auth-bypass-cve-2026-116606.html https://www.rescana.com/post/barracuda-esg-cve-2026-116606-111560-root-prepare-now Remediation: Update to version 9.4.0.030 or later.
10 assets checked · domain, subdomain, ipv4