Barracuda Email Security Gateway flaws expose devices to root compromise
Original title: Barracuda Email Security Gateway Flaws Expose Devices to Potential Root-Level Compromise
CVE-2026-116606 and CVE-2026-111560 could enable root access on ESG appliances.
Barracuda released patches for two vulnerabilities in Email Security Gateway appliances. CVE-2026-116606 is a pre-authentication authorization bypass (CVSS 9.3) and CVE-2026-111560 is a command injection flaw (CVSS 8.6). Both affect versions earlier than 9.4.0.030. Exploitation requires administrative interface access but could lead to root-level compromise when combined. Five additional product families are impacted by the command injection issue only. No active exploitation observed.
Unconfirmed: No active exploitation of these vulnerabilities observed
- Patches available for ESG versions 9.4.0.030 and later
- Command injection affects Load Balancer, Message Archiver, WAF and Web Security Gateway
- Administrative interface access remains a prerequisite
- Historical Barracuda ESG zero-day linked to UNC4841
- Organizations should restrict management interface exposure
Impact: unauthorized root access via authorization bypass and command injection
| Product | Affected | Fixed in |
|---|---|---|
| Barracuda Email Security Gateway | earlier than 9.4.0.030 | 9.4.0.030 and later |
- 1.Apply Barracuda patches BNSF-40425 or BNSF-40430
- 2.Restrict management interface access to trusted networks
- 3.Verify firmware version and patch status
- Vendors
- Barracuda
- Products
- Email Security Gateway
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-111560 | Command Injection in Barracuda Appliance Timezone Field | 8.6 | — | ||
| CVE-2026-116606 | Auth bypass in Barracuda Email Security Gateway before 9.4.0.030 | 9.3 | — |
From the original article
2 min read at gbhackers.com
Barracuda has released security patches for two vulnerabilities that could be exploited to bypass authorization controls and gain root access to affected Email Security Gateway (ESG) appliances. These vulnerabilities, identified as CVE-2026-116606 and CVE-2026-111560, require attackers to access the device’s administrative interface.
By Divya · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.