CVE-2026-116606
2026-11-02
13h17 +00:00
13h17 +00:00
指定 CVE 通知
掌握特定 CVE 的任何變更。
CVE 描述
An authentication bypass in Barracuda Email Security Gateway versions earlier than 9.4.0.030 allows an unauthenticated remote attacker to invoke a configuration-import function and restore a crafted, compatible backup archive, resulting in unauthorized modification of the appliance’s global configuration.
CVE 資訊
相關弱點
| 弱點名稱 | 來源 | |
|---|---|---|
| Authentication Bypass Using an Alternate Path or Channel The product requires authentication, but the product has an alternate path or channel that does not require authentication. |
CISA KEV（已知被利用漏洞）
漏洞名稱 : Barracuda Networks Email Security Gateway (ESG) Authentication Bypass Using an Alternate Path or Channel Vulnerability
必要行動 : Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
已知用於勒索軟體活動 : Unknown
新增日期 : 2026-11-10 00h00 +00:00
行動截止日期 : 2026-11-13 00h00 +00:00
重要資訊
根據已知被利用漏洞目錄（CISA KEV），此 CVE 已被識別為存在漏洞且構成主動威脅。CISA 已將此漏洞列為網路犯罪者正在積極利用的目標，強調立即採取行動修補此缺陷的重要性。必須優先更新和修復此 CVE，以保護系統免受潛在網路攻擊。
