THE CRUNCH
Barracuda has patched two vulnerabilities in its Email Security Gateway (ESG) appliances that, when chained together, can hand an attacker root access to the device. The first, CVE-2026-116606 with a CVSS score of 9.3, is an authentication bypass affecting only ESG. The second, CVE-2026-111560 with a CVSS score of 8.6, is a command injection flaw that also affects five other Barracuda products.
Mandiant's advisory describes the authentication bypass, present in ESG versions before 9.4.0.030, as letting a remote attacker with no credentials trigger a configuration-import feature and load a malicious but compatible backup archive, changing the appliance's global configuration. The command injection flaw lives in the timezone setting, within code that several Barracuda products share, and could let an attacker who already holds administrator rights run OS commands as root.
There is some disagreement over access requirements: Barracuda's advisory lists administrative access as needed for both bugs while also describing the authentication bypass as exploitable before login, whereas Mandiant says the ESG bug needs no authentication. Barracuda notes that exploitation requires network access to an appliance's admin interface, and recommends restricting those interfaces to trusted internal networks.
Outside ESG, the command injection issue also touches the Load Balancer Application Delivery Controller, Message Archiver, WAF Control Center, Web Application Firewall and Web Security Gateway. Neither advisory indicates whether the bugs have been abused by attackers. ESG appliances have been targeted before: Barracuda previously told customers to replace compromised devices after Chinese cyberspies exploited a zero-day, CVE-2023-2868, starting in October 2022.