Barracuda ESG Authentication Bypass Flaw Opens Path to Root

What it is

Barracuda has patched two vulnerabilities that chain to root on Email Security Gateway (ESG) appliances. CVE-2026-116606 (CVSS 9.3) is an authentication bypass that affects only ESG versions earlier than 9.4.0.030. CVE-2026-111560 (CVSS 8.6) is a command injection in the timezone configuration setting. Neither advisory says whether either flaw has been exploited in the wild.

How it works

Per Mandiant's advisory, an unauthenticated remote attacker can invoke the configuration-import function and restore a crafted, compatible backup archive. This changes the appliance's global configuration without authorization. The timezone bug sits in code shared across several Barracuda products. An attacker with administrator privileges can use it to run OS commands as root. Barracuda says that exploited together, the two let an attacker bypass authorization controls and reach root.

Preconditions / Affected

• CVE-2026-116606: ESG only, versions before 9.4.0.030.
• CVE-2026-111560: ESG plus five other products: Load Balancer ADC, Message Archiver, WAF Control Center, Web Application Firewall (WAF) and Web Security Gateway (WSG). The page gives no fixed versions for these.
• Barracuda says the attacker must be able to reach the appliance's admin interface for either bug.

What to do

• Update to the newest firmware and confirm every available patch is installed.
• Manually install any patch that was not applied automatically.
• Turn automatic patching back on for devices where it is disabled.
• Keep admin interfaces reachable only from trusted internal networks.

Caveats

• Barracuda's advisory marks admin access as required for both bugs, yet also calls CVE-2026-116606 a pre-authentication issue. Mandiant says the ESG bug works without authentication. Until this is settled, treat any ESG with a reachable admin interface as exposed to the full chain.
• Mandiant says Barracuda was told of the command injection on October 15 and the authentication bypass on October 22. The page does not give the year.
• ESG was targeted before: Chinese cyberspies exploited the zero-day CVE-2023-2868 from October 2022, and Barracuda told customers to replace compromised devices. The page does not link that campaign to these flaws.