Authentication Bypass Allows Global Configuration Restore in Barracuda Email Security Gateway

Summary

An authentication bypass in Barracuda Email Security Gateway versions earlier than 9.4.0.030 allows an unauthenticated remote attacker to invoke a configuration-import function and restore a crafted, compatible backup archive, resulting in unauthorized modification of the appliance’s global configuration.

Remediation

1. Inventory every Barracuda Networks Barracuda Email Security Gateway (ESG) deployment, including staging.
2. Upgrade Barracuda Networks Barracuda Email Security Gateway (ESG) to 9.4.0.030.
3. Confirm the running version after the upgrade.

References

• Advisoryhttps://github.com/mandiant/Vulnerability-Disclosures/blob/master/2026/MNDT-2026-0042.md
• Advisoryhttps://trust.barracuda.com/security/pre-authentication-authorization-bypass-command-injection