Barracuda ESG CVE-2026-116606

The attacker must be able to reach the Barracuda ESG appliance's management/web interface over the network and invoke its configuration-import (backup-restore) function; the authentication bypass means no credentials are required (PR:N). The one concrete prerequisite is supplying a crafted backup archive that is compatible with the target appliance's firmware, so it is accepted and restored. Limiting factors: only versions earlier than 9.4.0.030 are affected, and the attacker needs knowledge of a valid/compatible backup-archive format rather than an arbitrary payload. No user interaction or non-default configuration is required according to the available data.

This is a genuine high priority, not a high-CVSS-but-low-risk case. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N, score 9.3) describes a fully remote, unauthenticated, low-complexity attack with no user interaction and high impact to confidentiality, integrity and availability of the appliance (VC:H/VI:H/VA:H), consistent with CWE-288 authentication bypass. The vuln.today decision label is act_now and the flaw was reported by Mandiant, a credible source, which reinforces urgency. However, the input provides no CISA KEV entry, no EPSS probability, and no confirmed proof-of-concept/exploit code - the two references are a Mandiant disclosure page and a Barracuda advisory, i.e. vendor/researcher advisories rather than verified working exploit code. So severity and exploitability signals are high and mutually consistent, but there is no evidence in the supplied data of active exploitation; status is 'no public exploit identified at time of analysis.' One real-world mitigating nuance: the attacker must supply a crafted backup archive that is compatible with the target firmware, which is a modest technical prerequisite rather than a true barrier. Given Barracuda ESG's history as a targeted appliance and the act_now label, treat patching to 9.4.0.030 as urgent.

A remote attacker with network access to the ESG appliance's management interface invokes the configuration-import function without authenticating, bypassing access control (CWE-288). They upload a crafted but version-compatible backup archive that, once restored, overwrites the appliance's global configuration - for example adding an administrative account, disabling mail-security controls, or redirecting mail flow. No public exploit identified at time of analysis, but the attack is network-based, low-complexity, and requires no user interaction.