Barracuda patches ESG flaws that can enable root access

Barracuda has issued patches for two vulnerabilities that can be chained to gain root access on its Email Security Gateway (ESG) appliances. The authentication bypass, CVE-2026-116606 (CVSS 9.3), affects ESG versions earlier than 9.4.0.030 and allows an unauthenticated attacker to invoke a configuration-import function and restore a crafted, compatible backup archive, resulting in unauthorized modification of the appliance’s global configuration, according to Mandiant in its advisory.

The second flaw, CVE-2026-111560 (CVSS 8.6), is a command injection issue in timezone configuration code shared across several Barracuda products and could be exploited by an administrator-authenticated user to execute OS commands as root, per Mandiant’s advisory.

Barracuda notes that exploitation requires access to an appliance’s admin interface, and recommends restricting such interfaces to trusted internal networks. The command injection vulnerability also affects Load Balancer ADC, Message Archiver, WAF Control Center, Web Application Firewall (WAF), and Web Security Gateway (WSG). Barracuda and Mandiant separately state that the ESG bug can be exploited without authentication.

Patches have been released for ESG and the other affected products; Barracuda advises customers to update firmware and apply all patches, with manual installation for non-automatic patches and re-enabling automatic patching where disabled. It is not stated whether any exploits have occurred in the wild, and Barracuda reported the issues in October 2026, with disclosures on 15 and 22 October respectively.