CVE-2026-116606
2026-11-02
13h17 +00:00
13h17 +00:00
指定 CVE 通知
随时了解指定 CVE 的变更。
CVE 描述
An authentication bypass in Barracuda Email Security Gateway versions earlier than 9.4.0.030 allows an unauthenticated remote attacker to invoke a configuration-import function and restore a crafted, compatible backup archive, resulting in unauthorized modification of the appliance’s global configuration.
CVE 信息
相关弱点
| 弱点名称 | 来源 | |
|---|---|---|
| Authentication Bypass Using an Alternate Path or Channel The product requires authentication, but the product has an alternate path or channel that does not require authentication. |
CISA KEV（已知被利用漏洞）
漏洞名称 : Barracuda Networks Email Security Gateway (ESG) Authentication Bypass Using an Alternate Path or Channel Vulnerability
必要措施 : Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
已被用于勒索软件攻击活动 : Unknown
添加日期 : 2026-11-10 00h00 +00:00
截止日期 : 2026-11-13 00h00 +00:00
重要信息
根据 CISA KEV（已知被利用漏洞目录），此 CVE 被认定为存在漏洞且构成活跃威胁。CISA 已将该漏洞列为正被网络犯罪分子积极利用，并强调必须立即采取措施修复。请优先更新和修复此 CVE，以保护系统免遭潜在网络攻击。
