Barracuda Patches Two Flaws That Could Enable Root Access to ESG Appliances
Summary
Barracuda patched an ESG authentication bypass and a command injection flaw that can be chained for root access. The flaws affect six products; the advisories do not say whether they have been exploited in the wild.
Key points
- CVE-2026-116606 is an authentication bypass affecting Barracuda Email Security Gateway versions earlier than 9.4.0.030.
- CVE-2026-111560 is a command injection flaw in timezone configuration code shared across ESG and five other Barracuda products.
- Barracuda says the flaws could be chained to bypass authorization and gain root access; the command injection requires administrator privileges.
- The advisories differ on access requirements: Barracuda marks administrative access as required for both flaws, while Mandiant says the ESG bypass can be exploited without authentication.
- Barracuda advises updating to the newest firmware, manually applying any patches not installed automatically, and limiting admin interfaces to trusted internal networks.
- Neither advisory says whether the vulnerabilities have been exploited in the wild.
Article Details
- Vulnerability Types
- Authentication bypass
- Command injection
- Severity
- CVE-2026-116606: CVSS 9.3; CVE-2026-111560: CVSS 8.6
- Affected Versions
- Barracuda Email Security Gateway (ESG) versions earlier than 9.4.0.030
- Exploitation Status
- unknown
- Exploit Availability
- unknown
- Patch Status
- available
- Workarounds
- Restrict appliance admin interfaces to trusted internal networks.
- Install the newest firmware and confirm all available patches are installed; manually install patches not applied automatically and re-enable automatic patching if disabled.
MITRE ATT&CK
T1059 · Command and Scripting InterpreterThe command injection flaw can be used to execute OS commands as root, according to Mandiant.T1190 · Exploit Public-Facing ApplicationThe vulnerabilities affect network-reachable Barracuda appliances; the ESG authentication bypass can be exploited remotely without authentication, according to Mandiant.
CVE
CVE-2023-2868Barracuda · Barracuda Email Security GatewayESG appliances were previously targeted by Chinese cyberspies who exploited a zero-day, CVE-2023-2868, starting in October 2022. That campaign led Barracuda to tell customers to replace compromised devices.CVE-2026-111560Barracuda Networks · Barracuda Email Security Gateway (ESG); Barracuda Networks · Barracuda Load Balancer Application Delivery Controller (ADC); +4 moreCVE-2026-116606 (CVSS score of 9.3), is an authentication bypass that affects only ESG. The second, CVE-2026-111560 (CVSS score of 8.6), is a command injection issue that also impacts five other Barracuda products.CVE-2026-116606Barracuda Networks · Barracuda Email Security Gateway (ESG)The first, tracked as CVE-2026-116606 (CVSS score of 9.3), is an authentication bypass that affects only ESG. The second, CVE-2026-111560 (CVSS score of 8.6), is a command injection issue that also impacts five other
Vendors
Products
Email Security Gateway (ESG)Barracuda has released patches for two vulnerabilities that can be chained to gain root access to its Email Security Gateway (ESG) appliances.Load Balancer Application Delivery Controller (ADC)In addition to ESG, the command injection flaw affects the Load Balancer Application Delivery Controller (ADC), Message Archiver, WAF Control Center, Web Application Firewall (WAF), and Web Security Gateway (WSG).Message ArchiverIn addition to ESG, the command injection flaw affects the Load Balancer Application Delivery Controller (ADC), Message Archiver, WAF Control Center, Web Application Firewall (WAF), and Web Security Gateway (WSG).WAF Control CenterIn addition to ESG, the command injection flaw affects the Load Balancer Application Delivery Controller (ADC), Message Archiver, WAF Control Center, Web Application Firewall (WAF), and Web Security Gateway (WSG).Web Application Firewall (WAF)In addition to ESG, the command injection flaw affects the Load Balancer Application Delivery Controller (ADC), Message Archiver, WAF Control Center, Web Application Firewall (WAF), and Web Security Gateway (WSG).Web Security Gateway (WSG)In addition to ESG, the command injection flaw affects the Load Balancer Application Delivery Controller (ADC), Message Archiver, WAF Control Center, Web Application Firewall (WAF), and Web Security Gateway (WSG).