CVE-2026-1166069.3Critical
Authentication Bypass Allows Global Configuration Restore in Barracuda Email Security Gateway
Barracuda Networks · Barracuda Email Security Gateway (ESG)
Not in CISA KEVVendor fix available
No EPSS score yet. The score appears once FIRST publishes it.
9.3CriticalCVSS
LowMediumHighCrit.
DescriptionNVD
An authentication bypass in Barracuda Email Security Gateway versions earlier than 9.4.0.030 allows an unauthenticated remote attacker to invoke a configuration-import function and restore a crafted, compatible backup archive, resulting in unauthorized modification of the appliance’s global configuration.
Coverage1 article · 1 outlet
First in our coverage: SecurityOnline, 2 Nov.
- Barracuda fixes flaws that could give attackers appliance root accessSecurityOnline · first in our coverage
New articles also arrive in the RSS feed.