{
    "id": "CVE-2026-116606",
    "published": "2026-11-02 13:17:37",
    "last_modified": "2026-11-10 20:18:04",
    "cvss_score": null,
    "cvss_severity": null,
    "cvss_version": null,
    "cvss_vector": null,
    "cwe": "CWE-288",
    "description": "An authentication bypass in Barracuda Email Security Gateway versions earlier than 9.4.0.030 allows an unauthenticated remote attacker to invoke a configuration-import function and restore a crafted, compatible backup archive, resulting in unauthorized modification of the appliance’s global configuration.",
    "epss_score": "0.01602",
    "epss_percentile": "0.76026",
    "kev": 1,
    "kev_due": "2026-11-13",
    "has_exploit": 0,
    "updated_at": "2026-11-11 00:17:02",
    "priority": {
        "rank": 1,
        "label": "Patch first",
        "why": "On CISA KEV — known exploited in the wild, due 2026-11-13."
    },
    "products": [],
    "kev_detail": {
        "cve_id": "CVE-2026-116606",
        "date_added": "2026-11-10",
        "due_date": "2026-11-13",
        "vendor": "Barracuda Networks",
        "product": "Barracuda Email Security Gateway (ESG)",
        "name": "Barracuda Networks Email Security Gateway (ESG) Authentication Bypass Using an Alternate Path or Channel Vulnerability",
        "ransomware": 0
    },
    "exploits": [],
    "refs_list": [
        "https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2026/MNDT-2026-0042.md",
        "https://trust.barracuda.com/security/pre-authentication-authorization-bypass-command-injection",
        "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-116606"
    ]
}