Barracuda patches two chained flaws for root access
Original title: Two Barracuda ESG Flaws Could Be Combined for Full Root Access; Patches Released
Barracuda released patches for CVE-2026-116606 and CVE-2026-111560 in ESG appliances that can be combined to grant attackers full root access.
Barracuda identified a pre-authentication authorization bypass (CVE-2026-116606, CVSS 9.3) allowing unauthenticated configuration changes and a command injection flaw (CVE-2026-111560, CVSS 8.6) enabling OS command execution as root when combined. The vulnerabilities affect multiple products including Email Security Gateway, Load Balancer ADC, Message Archiver, WAF Control Center, Web Application Firewall and Web Security Gateway. Patches are available with specific version recommendations and firmware updates.
Unconfirmed: No confirmed exploitation of the vulnerabilities
- CVE-2026-116606 allows config modification
- CVE-2026-111560 enables root command execution
- Combined exploitation yields full root access
- Patches released for versions below 9.4.017
- Recommend step-by-step updates if behind current firmware
Impact: combined root access to Email Security Gateway appliances
| Product | Affected | Fixed in |
|---|---|---|
| Barracuda Email Security Gateway | 9.4.017 or later | BNSF-40425 |
| Barracuda Email Security Gateway | below 9.4.017 | BNSF-40430 |
| Barracuda Load Balancer Application Delivery Controller | — | BNADC-16586 |
| Barracuda Message Archiver | — | BNMA-32468 |
| Barracuda WAF Control Center | — | BNWF-60060 |
| Barracuda Web Application Firewall | — | BNADC-16586 |
| Barracuda Web Security Gateway | — | BNYF-24789 |
- 1.update to latest firmware
- 2.install appropriate patches
- 3.restrict administrative interfaces to trusted networks
- Vendors
- Barracuda
- Products
- Email Security Gateway
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-111560 | Command Injection in Barracuda Appliance Timezone Field | 8.6 | — | ||
| CVE-2026-116606 | Auth bypass in Barracuda Email Security Gateway before 9.4.0.030 | 9.3 | — |
From the original article
2 min read at securityaffairs.com
Barracuda patched two flaws that can be chained to give attackers root access to Email Security Gateway appliances. Barracuda has patched two vulnerabilities that can be chained to gain root access to its Email Security Gateway (ESG) appliances. CVE-2026-116606 (CVSS score of 9.
By Pierluigi Paganini · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.