Barracuda Email Security Gateway - Authentication Bypass

An authentication bypass in Barracuda Email Security Gateway versions earlier than 9.4.0.030 allows an unauthenticated remote attacker to invoke a configuration-import function and restore a crafted, compatible backup archive, resulting in unauthorized modification of the appliance’s global...

holehe

Holehe OSINT - Email to Registered Accounts 👋 Hi there! For any professional inquiries or collaborations, please reach out to me at: [email protected] 📧 Preferably, use your professional email for correspondence. Let's keep it short and sweet, and all in English! Holehe Online Version Summar...

sublime-rules

Sublime Rules by Sublime Security This repo contains open-source rules for Sublime for detecting and preventing email attacks like BEC, malware, and credential phishing. Try out the cloud offering for free at Sublime Cloud Examples HTML smuggling VIP / Executive impersonation Malicious OneNote...

prompt-injection-email-samples

Prompt-Injection Email Samples A small, open test set of emails for checking whether your email security controls and AI mailbox assistants handle indirect prompt injection : instructions hidden in an email that try to hijack an AI assistant when it reads, summarizes or acts on that email. The se...

SonicWall Email Security <= 10.0.9.x - Unauthenticated Admin Account Creation

SonicWall Email Security version 10.0.9.x allows an attacker to create an administrative account by sending a crafted HTTP request to the remote host. id: CVE-2021-20021 info: name: SonicWall Email Security = 10.0.9.x - Unauthenticated Admin Account Creation author: pussycat0x severity: critical...

watchTowr-vs-Barracuda-RCE-CVE-2026-116606-CVE-2026-111560

watchTowr-vs-Barracuda-RCE Detection Artifact Generator for Barracuda Email Security Gateway ESG Auth bypass to comomand injection CVE-2026-116606, CVE-2026-111560 See our blog post for technical details. Detection in Action $ python3 'watchTowr-vs-Barracuda.py' --target https://barracuda-esg...

Vulnerabilities fixed in Barracuda Email Security Gateway

Barracuda has patched vulnerabilities in the Barracuda Email Security Gateway. Barracuda identified two vulnerabilities across various Barracuda products: one related to authorization bypass CVE-2026-116606 and another related to command injection CVE-2026-111560. The first vulnerability involves...

Barracuda Networks Email Security Gateway (ESG) Authentication Bypass Using an Alternate Path or Channel Vulnerability

Barracuda Networks Email Security Gateway ESG contains an authentication bypass using an alternate path or channel that could allow an unauthenticated remote attacker to invoke a configuration-import function and restore a crafted, compatible backup archive, resulting in unauthorized modification...

Barracuda Networks Multiple Products OS Command Injection Vulnerability

Barracuda Networks Email Security Gateway ESG, Load Balancer, Application Delivery Controller ADC, Message Archiver BMA, WAF Control Center WCC, Web Application Firewall WAF, and Web Security Gateway WSG contain an OS command injection vulnerability. This vulnerability could allow an authenticate...

VulnCheck KEV: CVE-2026-116606

Barracuda Networks Email Security Gateway ESG contains an authentication bypass using an alternate path or channel that could allow an unauthenticated remote attacker to invoke a configuration-import function and restore a crafted, compatible backup archive, resulting in unauthorized modification...

Barracuda Flaws Could Be Chained to Bypass Authorization and Gain Root Access

Barracuda has disclosed details of two vulnerabilities affecting its products that, if chained together, could allow an attacker to bypass authorization controls and gain root access to a susceptible device. The vulnerabilities, a pre-authentication authorization bypass vulnerability and a comman...

CVE-2026-116606

An authentication bypass in Barracuda Email Security Gateway versions earlier than 9.4.0.030 allows an unauthenticated remote attacker to invoke a configuration-import function and restore a crafted, compatible backup archive, resulting in unauthorized modification of the appliance’s global...

CVE-2026-116606 Authentication Bypass Allows Global Configuration Restore in Barracuda Email Security Gateway

An authentication bypass in Barracuda Email Security Gateway versions earlier than 9.4.0.030 allows an unauthenticated remote attacker to invoke a configuration-import function and restore a crafted, compatible backup archive, resulting in unauthorized modification of the appliance’s global...

EUVD-2026-115149

An authentication bypass in Barracuda Email Security Gateway versions earlier than 9.4.0.030 allows an unauthenticated remote attacker to invoke a configuration-import function and restore a crafted, compatible backup archive, resulting in unauthorized modification of the appliance’s global...

CVE-2026-116606 Authentication Bypass Allows Global Configuration Restore in Barracuda Email Security Gateway

An authentication bypass in Barracuda Email Security Gateway versions earlier than 9.4.0.030 allows an unauthenticated remote attacker to invoke a configuration-import function and restore a crafted, compatible backup archive, resulting in unauthorized modification of the appliance’s global...

CVE-2026-116606

An authentication bypass in Barracuda Email Security Gateway versions earlier than 9.4.0.030 allows an unauthenticated remote attacker to invoke a configuration-import function. By restoring a crafted, compatible backup archive, an attacker can achieve unauthorized modification of the appliance’s...

PT-2026-135431

Name of the Vulnerable Software and Affected Versions Barracuda Email Security Gateway versions prior to 9.4.0.030 Description An authentication bypass allows an unauthenticated remote attacker to invoke a configuration-import function and restore a crafted, compatible backup archive. This action...

CVE-2026-116606: Barracuda Networks Barracuda Email Security Gateway (ESG): An authentication bypass in Barracuda Email Security Gateway versions earlier than 9.4.0.030 allows an unauthenticated…

An authentication bypass in Barracuda Email Security Gateway versions earlier than 9.4.0.030 allows an unauthenticated remote attacker to invoke a configuration-import function and restore a crafted, compatible backup archive, resulting in unauthorized modification of the appliance’s global...

CVE-2026-116272

A flaw was found in perl-mime-tools. A remote attacker can bypass email security filters by sending a specially crafted message containing duplicate Multipurpose Internet Mail Extensions MIME boundary parameters with nested comments. Because the parser fails to properly normalize parameter names...

CVE-2026-116265

A flaw was found in perl-MIME-tools. A remote attacker can exploit this vulnerability to bypass email security filters by sending an email with specially crafted multipart boundary parameters. Because the parser does not properly validate boundary parameters split across continuations, it process...