cyber.hendryadrian.com
Vulnerability & Exploit · fieldeffect.com

Barracuda ESG Flaws Can Be Chained to Gain Root Access

· Original article ↗

Summary

Two Barracuda vulnerabilities can be chained to bypass authorization and gain root access to ESG appliances. Exploitation requires access to the administrative interface; no exploitation has been reported in this case.

Key points

  • CVE-2026-116606 is a pre-authentication authorization bypass involving ESG configuration import and restore; versions before 9.4.0.030 are affected.
  • CVE-2026-111560 is a command injection flaw affecting ESG and several other Barracuda appliances.
  • On ESG, the flaws can be chained to bypass authorization controls and obtain root access. Barracuda says access to the administrative interface is required; user interaction is not required.
  • No exploitation of these vulnerabilities has been reported in this case.
  • Barracuda addressed both flaws; identify affected appliances and apply the appropriate updates. Older firmware may require multiple upgrade steps.
  • Restrict administrative interfaces to trusted management networks and review access logs, configuration restores, and changes for unexpected activity.

Article Details

Vulnerability Types
  • Pre-authentication authorization bypass
  • Command injection
Severity
CVE-2026-116606: CVSS 9.3; CVE-2026-111560: CVSS 8.6
Affected Versions
  • Email Security Gateway (ESG) versions prior to 9.4.0.030
Exploitation Status
not_reported
Exploit Availability
unknown
Patch Status
available
Workarounds
  • Restrict administrative access to trusted management networks.

CVE

CVE-2026-111560Barracuda Networks · Barracuda Email Security Gateway (ESG); Barracuda Networks · Barracuda Load Balancer Application Delivery Controller (ADC); +4 moreOn November 2, 2026, Barracuda Networks addressed two vulnerabilities, CVE-2026-116606 and CVE-2026-111560, affecting several of its security appliances.CVE-2026-116606Barracuda Networks · Barracuda Email Security Gateway (ESG)On November 2, 2026, Barracuda Networks addressed two vulnerabilities, CVE-2026-116606 and CVE-2026-111560, affecting several of its security appliances.

Threat Actors

UNC4841The article reports that UNC4841 exploited a different ESG vulnerability in 2023 for months to compromise appliances and steal data.

Vendors

BarracudaPrioritize patching affected Barracuda Networks appliances, especially ESG systems, and review administrative access controls and appliance activity for indications of unauthorized access or exploitation.

Products

Email Security Gateway (ESG)Two vulnerabilities can be chained on Barracuda Email Security Gateway (ESG) to obtain root access to the appliance.Load Balancer Application Delivery Controller (ADC)CVE-2026-111560, is described as a command injection vulnerability affecting ESG, Load Balancer Application Delivery Controller (ADC), Web Application Firewall (WAF), Web Security Gateway (WSG), Message ArchiverMessage Archiver (BMA)Delivery Controller (ADC), Web Application Firewall (WAF), Web Security Gateway (WSG), Message Archiver (BMA), and WAF Control Center (WCC).WAF Control Center(ADC), Web Application Firewall (WAF), Web Security Gateway (WSG), Message Archiver (BMA), and WAF Control Center (WCC).Web Application Firewall (WAF)injection vulnerability affecting ESG, Load Balancer Application Delivery Controller (ADC), Web Application Firewall (WAF), Web Security Gateway (WSG), Message Archiver (BMA), and WAF Control Center (WCC).Web Security Gateway (WSG)ESG, Load Balancer Application Delivery Controller (ADC), Web Application Firewall (WAF), Web Security Gateway (WSG), Message Archiver (BMA), and WAF Control Center (WCC).

Related Articles