Barracuda has released patches for two vulnerabilities that can be chained to gain root access to its Email Security Gateway (ESG) appliances.
The first, tracked as CVE-2026-116606 (CVSS score of 9.3), is an authentication bypass that affects only ESG. The second, CVE-2026-111560 (CVSS score of 8.6), is a command injection issue that also impacts five other Barracuda products.
“An authentication bypass in Barracuda Email Security Gateway versions earlier than 9.4.0.030 allows an unauthenticated remote attacker to invoke a configuration-import function and restore a crafted, compatible backup archive, resulting in unauthorized modification of the appliance’s global configuration,” Mandiant explains in an advisory describing CVE-2026-116606.
The command injection bug sits in the timezone configuration setting, in code shared across several Barracuda products. Mandiant says an attacker logged in with administrator privileges could abuse it to execute OS commands as root.
“If exploited in combination, these vulnerabilities could allow an attacker to bypass authorization controls and obtain root access to the device,” Barracuda says.
In addition to ESG, the command injection flaw affects the Load Balancer Application Delivery Controller (ADC), Message Archiver, WAF Control Center, Web Application Firewall (WAF), and Web Security Gateway (WSG).
According to Barracuda, attackers must be able to reach an appliance’s admin interface to exploit the flaws. The company advises organizations to keep these interfaces reachable only from trusted internal networks.
Barracuda’s advisory marks administrative access as required for both bugs, yet also calls CVE-2026-116606 a pre-authentication issue. Mandiant, which published advisories for both flaws, says the ESG bug can be exploited without authentication.
Customers are advised to update to the newest firmware and confirm that every available patch is installed. Barracuda says any patch not applied automatically should be manually installed, and that devices with automatic patching disabled should have it switched back on.
According to Mandiant, Barracuda reported the command injection on October 15 and the authentication bypass on October 22. Neither advisory says whether the flaws have been exploited in the wild.
ESG appliances were previously targeted by Chinese cyberspies who exploited a zero-day, CVE-2023-2868, starting in October 2022. That campaign led Barracuda to tell customers to replace compromised devices.
Related: Critical Node-RED Flaw Exploited in Attacks
Related: Ivanti Patches Two More Zero-Days Exploited in Connect Secure Attack Chain
Related: Drupal Commerce Core Vulnerability Exploited Against Online Stores
