Barracuda flaws can be chained to gain root access

Barracuda has disclosed two vulnerabilities in its Email Security Gateway (ESG) family that can be chained to yield root access on affected devices. The pre-authentication authorization bypass, CVE-2026-116606 (CVSS 9.3), allows unauthenticated attackers to modify appliance configurations, while CVE-2026-111560 (CVSS 8.6) is a command injection flaw impacting six Barracuda products.

In Barracuda’s advisory, the company notes that successful exploitation requires access to the affected product’s administrative interface; when combined, these flaws could bypass authorisation controls and grant root privileges on the device.

Barracuda has released patches for the affected models and instructs customers to verify firmware versions and apply updates promptly. Specific remediation includes BNSF-40425 for ESG version 9.4.017 or later, and BNSF-40430 for ESG versions prior to 9.4.017, with additional fixes for other products affected by CVE-2026-111560 via BNADC-16586 (Load Balancer ADC and Web Application Firewall), BNMA-32468 (Message Archiver), BNWF-60060 (WAF Control Center), and BNYF-24789 (Web Security Gateway).

Barracuda recommends restricting administrative interfaces to trusted networks, ensuring devices run the latest firmware, and applying patches in steps if several versions are behind. If patching is automatic, devices should remain enabled for automatic updates; otherwise, manual patching should be performed per the Barracuda Campus guidance. The company urges customers to contact Barracuda Support if assistance is needed.