Barracuda ESG CVE-2026-116606: CVE record says unauthenticated, Barracuda says admin access is required

Eleven days, then two readings of one flaw

Mandiant's advisory file for CVE-2026-116606 prints 22 October 2026 as the date the flaw was "Reported by Barracuda" and 2 November as the date the CVE was published. That is 11 days (derived). On the day of publication the two pages that matter describe the same flaw in opposite terms. The CVE record, Mandiant's file and the GitHub advisory built from them say an "unauthenticated remote attacker" can invoke a configuration import function on a Barracuda Email Security Gateway (ESG) and restore a crafted backup archive. Barracuda's own page says that exploitation "requires an attacker to have access to the administrative interface" of an affected product and lists "Authentication Required: Yes, administrative access".

Both were read between 18:33 and 18:36 GMT on Monday 2 November 2026, within hours of publication. Barracuda titles its page "Pre-Authentication Authorization Bypass and Command Injection Vulnerabilities", so the vendor's own headline says pre-authentication while its own table says authentication is required. This briefing sets the two readings side by side, says what each establishes, and gives a ranked checklist that works whichever reading proves right.

Stated and not stated

The first row is the one that changes what a defender does. If the CVE record is right, anything that can reach the interface can attempt the import without credentials. If Barracuda's table is right, an attacker needs more than network reach. Barracuda's own sentence that organisations whose administrative interfaces are not publicly accessible "are less exposed to this attack path" fits both readings, and so does its advice to restrict those interfaces.

The path as the sources state it

Zoom

The CVE record's description is one sentence: an authentication bypass in ESG versions earlier than 9.4.0.030 "allows an unauthenticated remote attacker to invoke a configuration-import function and restore a crafted, compatible backup archive, resulting in unauthorized modification of the appliance's global configuration." Mandiant's file adds CAPEC-115, Authentication Bypass, and the weakness class CWE-288, Authentication Bypass Using an Alternate Path or Channel. That class means a protected function can be reached by a route that does not apply the usual check. It does not say which route.

Configuration import is a feature name, not a risk description. To an administrator it sounds like housekeeping. The record says what the function becomes in the wrong hands: a way to replace the appliance's global configuration. A mail gateway sits in the path of inbound and outbound mail, so the stakes depend on what that configuration holds. The sources do not list it. Routing, filtering rules, administrator accounts and stored credentials are all plausible contents of a gateway configuration, but that is this site's inference, and no source read confirms any of them.

Compatible is a label for a constraint that is not printed. An archive is restored only if it is compatible, which implies a check on version, format or contents. A defender would like to know whether that check is also a barrier for an attacker, for example whether a valid archive must come from the same appliance. The sources do not say. Treating compatible as reassurance would be the friendly name fallacy applied to an adjective.

Barracuda's chain is stated, its mechanism is not. The vendor's overview says that if CVE-2026-116606 and CVE-2026-111560 are "exploited in combination", an attacker could bypass authorisation and "obtain root access to the device". CVE-2026-111560 is a command injection in the timezone configuration field of certain appliance products using common Barracuda code, requiring an authenticated administrator, scored 8.6 with Privileges Required: High, affecting ESG up to 9.4.0.27. Read together, the bypass supplies the missing authentication and the injection supplies the code execution. That sentence is this site's reading of Barracuda's summary. Neither the CVE record nor Mandiant's file says that a restored configuration reaches the timezone field, and the diagram marks that link as not stated.

Pre-authentication is also a label. Barracuda's page uses it in its title and in the overview, then lists Authentication Required: Yes, administrative access in the advisory block for the same CVE. One reasonable explanation is that the vendor means the flaw is reachable before login but only on the administrative interface. Another is a drafting inconsistency. The page does not say, and the CVE record's Privileges Required: None was assigned by a different party, the CNA. A reader should not choose between them on a guess.

Dates, and the one that is missing

Zoom

Mandiant's file lists two dates for CVE-2026-116606: 2026-10-22 "Reported by Barracuda" and 2026-11-02 "CVE published and Mandiant advisory released". The CVE record shows the ID was reserved on 26 October, four days after the report date (derived), and published at 12:59:11 GMT on 2 November, seven days after reservation (derived). The companion command injection, CVE-2026-111560, follows the same shape: reported 15 October, reserved 16 October, published at 12:59:03 GMT on 2 November, 18 days after the report date (derived). The CVE records name Mandiant as the CNA, the body that assigned them.

Other postings followed in order: NVD at 13:17 GMT (18 minutes after the CVE record, derived), Barracuda's page at 13:58 GMT (about 59 minutes, derived, from the publication time in its own page data), and the GitHub advisory at 15:31 GMT (152 minutes, derived). Barracuda's page and its table both print the advisory date as 2 November 2026.

The fix date is not printed. Barracuda says it "immediately initiated a comprehensive remediation process and released security patches" and gives no date. Mandiant's file prints no fix date. The gap between the release of a fix and the public write up therefore cannot be computed from these sources, and this briefing does not guess it. What the timeline does show is a coordinated publication: the two CVE records appeared about 8 seconds apart (derived), and the vendor page, the NVD entry and the GitHub advisory followed within about two and a half hours.

Who found the flaw is also thin. "Reported by Barracuda" in Mandiant's file reads as Barracuda reporting to the CNA, and Barracuda's page says it "has identified" the vulnerabilities. The CVE record's discovery field says UNKNOWN. Anyone writing that Mandiant discovered it would be going beyond the record.

The fix, and how Barracuda says it arrives

Barracuda says the device "will show the latest firmware version available" and that a device several versions behind "may need to perform more than one update". It points customers to Barracuda Support. That is the delivery model the page states: patches pushed automatically where automatic patching is on, and manual application otherwise. The page does not say whether the 9.4.0.030 build is delivered the same way, and it does not say whether virtual or cloud ESG forms follow a different route. Those are questions for Barracuda Support, not for inference.

Exploitation, exposure and earlier ESG history

The CISA catalogue read at 18:33 GMT is version 2026.10.30, released at 17:02 GMT on 30 October, with 1,766 entries. Neither CVE-2026-116606 nor CVE-2026-111560 is in it. The catalogue is three days older than the records (derived), so it could not yet have reflected them. Absence from KEV on this date says only that CISA had not listed them. Neither Barracuda's page nor Mandiant's file says anything about exploitation in the wild, and the NVD entry is still Awaiting Analysis, so it carries no CISA assessment.

The same catalogue does hold one earlier ESG entry, CVE-2023-2868, added 2023-05-26 and described there as an improper input validation vulnerability of a user supplied .tar file leading to remote command injection. The two sources about this flaw do not mention it. It is not evidence about CVE-2026-116606, and the only reason to note it is that readers will look for it. A history of past ESG flaws is context for how much attention an appliance deserves. It is not proof of anything here.

No source gives a number of exposed appliances. Barracuda's own wording, that organisations whose interfaces are not publicly accessible are less exposed, is the only exposure statement.

What to do, in order

Technical details

Barracuda's page, the CVE records and Mandiant's two files print no request, payload, command, log line, hash, domain or address for this flaw, and none is reproduced here. The artifacts they do print are the description, the scores, the versions, the patch table and the dates. A defender uses the versions to check inventory, the description to understand what to hunt, and the dates to anchor an investigation. Nothing below is exploit code.

The CVE record's description for CVE-2026-116606, which the GitHub advisory and the NVD entry repeat word for word. Copied exactly, including its apostrophe.

An authentication bypass in Barracuda Email Security Gateway versions earlier than 9.4.0.030 allows an unauthenticated remote attacker to invoke a configuration-import function and restore a crafted, compatible backup archive, resulting in unauthorized modification of the appliance’s global configuration.

The CVSS 4.0 vector and score in the CVE record. Privileges Required is NONE here. The same vector is printed in Mandiant's file with the score in brackets.

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
baseScore 9.3  baseSeverity CRITICAL
CWE-288: Authentication Bypass Using an Alternate Path or Channel
CAPEC-115: Authentication Bypass

The affected version range as the CVE record gives it, formatted onto lines by this site (derived layout, values exact). The NVD entry repeats it. Use it to check which ESG firmware strings fall below the boundary.

vendor: Barracuda Networks
product: Barracuda Email Security Gateway (ESG)
status: affected
version: 0
lessThan: 9.4.0.030
versionType: custom
defaultStatus: unaffected

Barracuda's advisory block for the same CVE, and the ESG row of its patch table (the table row is laid out on one line by this site, values exact). Note the two lines that bear on the authentication question.

CVE: CVE-2026-116606
Vulnerability Type: Pre-Authentication Authorization Bypass
Affected Product: ESG
Severity: High
CVSS Score: 9.3
Authentication Required: Yes, administrative access
Remediation: Upgrade to the latest firmware version
Advisory Published: November 2, 2026
Advisory Updated: November 2, 2026

Patch for Email Security Gateway (ESG): BNSF-40425 (9.4.017+), BNSF-40430 (<9.4.017)

Mandiant's disclosure timeline for the configuration import flaw, copied from its advisory file, and its exploitability line, which the CVE record's scoring follows.

* 2026-10-22: Reported by Barracuda
* 2026-11-02: CVE published and Mandiant advisory released

Exploitability
High: The vulnerability is exposed to an unauthenticated remote attacker.

The companion flaw, CVE-2026-111560, whose description names the field involved. This is the vendor's and Mandiant's description of a weakness, with no value, field syntax or payload. Affected ESG range from Mandiant's file.

Improper neutralization of shell metacharacters in the timezone configuration field in certain Barracuda appliance products using common Barracuda code allows an authenticated administrator to inject OS commands that execute with root privileges when the crafted timezone value is subsequently processed.

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
baseScore 8.6  baseSeverity HIGH

Barracuda Email Security Gateway (ESG) <= 9.4.0.27

The result of this site's own check of the CISA catalogue, a derived summary of what it contained, not a copy of CISA's text. Re-run it before relying on it.

catalogVersion: 2026.10.30
dateReleased: 2026-10-30T17:02:45Z
entries: 1766
CVE-2026-116606 present: false
CVE-2026-111560 present: false
Barracuda entries in catalogue: CVE-2023-2868 (Email Security Gateway (ESG) Appliance), dateAdded 2023-05-26

The question that exposes the gap

A mail gateway is trusted because it stands between the internet and the inbox. A flaw that lets someone replace its global configuration is serious whichever party is right about the login. But the two readings lead to different priorities, and the vendor and the CNA published them on the same day. If an unauthenticated caller can restore a configuration on an ESG, why does Barracuda's own table say Authentication Required: Yes, and if a login is required, why does the CVE record score Privileges Required as None? Until one of them corrects its page, which one should the owner of an exposed appliance believe?

Key facts