An authentication bypass in Barracuda Email Security Gateway versions earlier than 9.4.0.030 allows an unauthenticated remote attacker to invoke a configuration-import function and restore a crafted, compatible backup archive, resulting in unauthorized modification of the appliance's global configuration.
High: An unauthenticated remote attacker may bypass authentication and restore a crafted, compatible backup archive, resulting in unauthorized modification of the appliance's global configuration.
High: The vulnerability is exposed to an unauthenticated remote attacker.
Common Weakness Enumeration
CWE-288: Authentication Bypass Using an Alternate Path or Channel
Common Attack Pattern Enumeration and Classification
CAPEC-115: Authentication Bypass
The affected product and version is:
Barracuda Email Security Gateway (ESG) < 9.4.0.030
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N (9.3)
2026-10-22: Reported by Barracuda
2026-11-02: CVE published and Mandiant advisory released
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
