Barracuda has released fixes for two vulnerabilities that can be chained to gain root access to its Email Security Gateway (ESG) appliances.
The first, tracked as CVE-2026-116606 (CVSS score 9.3), is an authentication bypass that only affects ESG. The second, CVE-2026-111560 (CVSS score 8.6), is a command injection issue that also affects five other Barracuda products.
“An authentication bypass in Barracuda Email Security Gateway versions prior to 9.4.0.030 allows an unauthenticated, remote attacker to invoke a configuration import function and restore a crafted, compatible backup archive, resulting in an unauthorized modification of the overall appliance configuration,” Mandiant said in a statement. advisory describing CVE-2026-116606.
The command injection bug resides in the time zone configuration setting, in code shared between multiple Barracuda products. Mandiant says an attacker logged in with administrator privileges could abuse them to execute operating system commands as root.
“If exploited together, these vulnerabilities could allow an attacker to bypass authorization controls and gain root access to the device,” Barracuda says.
In addition to ESG, the command injection flaw affects the Load Balancer Application Delivery Controller (ADC), Message Archiver, WAF Control Center, Web Application Firewall (WAF), and Web Security Gateway (WSG).
According to Barracuda, attackers must be able to access the administration interface of an appliance to exploit the flaws. The company advises organizations to keep these interfaces accessible only from trusted internal networks.
Barracuda’s advisory states that administrative access is required for both bugs, but also calls CVE-2026-116606 a pre-authentication issue. Mandiant, which published notice for both flaws, the ESG bug can be exploited without authentication.
Customers are advised to update to the latest firmware and confirm that all available patches are installed. Barracuda says any patch not applied automatically must be installed manually and devices with automatic patches turned off should re-enable it.
According to Mandiant, Barracuda reported command injection on October 15 and authentication bypass on October 22. Neither opinion specifies whether the flaws were exploited in the wild.
ESG devices have previously been targeted by Chinese cyberspies who exploited a zero-day, CVE-2023-2868, starting in October 2022. This campaign led Barracuda to ask its customers to replace compromised devices.
Related: Critical flaw in Node-RED exploited during attacks
Related: Ivanti Fixes Two More Zero-Days Exploited in Connect Secure Attack Chain
Related: Drupal Commerce main vulnerability exploited against online stores
