Barracuda patches chained flaws that can give root on ESG
November 6: The Hacker News says experts demonstrated the unauthenticated root chain and cites ESG fixes in 9.4.0.030 and later. November 5: watchTowr says the chain is pre-auth remote root RCE, fixed in 9.4.0.029.
Barracuda has patched two flaws that can be chained for root on Email Security Gateway and related appliances; no active exploitation is reported.
Barracuda disclosed two vulnerabilities that can be chained to gain root on Email Security Gateway appliances when the administrative interface is reachable. CVE-2026-116606 is a pre-authentication authorization bypass, rated 9.3, that can change configuration; CVE-2026-111560 is a command-injection flaw, rated 8.6, that can run OS commands as root. The bypass is described as affecting ESG, while the injection also affects Load Balancer ADC, Message Archiver, WAF, WAF Control Center and Web Security Gateway. Patches are available and Barracuda urges restricting admin interfaces to trusted networks. Outlets disagree on the fixed ESG build: BleepingComputer and Security Affairs cite 9.4.017, watchTowr 9.4.0.029, and GBHackers and The Hacker News 9.4.0.030. Several outlets report no known active exploitation.
- CVE-2026-116606 is a pre-auth authorization bypass rated CVSS 9.3.
- CVE-2026-111560 is command injection as root, rated CVSS 8.6.
- Injection also hits ADC, Message Archiver, WAF, WCC and Web Security Gateway.
- Exploitation requires reachability of the administrative interface.
- No active exploitation reported by GBHackers, Cyber Security News, watchTowr and The Hacker News.
What each outlet adds
beyond the shared facts- SecurityWeekBypass allows unauthenticated remote configuration import; injection runs commands as root.
- watchTowr LabsAnalyzed ESG 9.4.0.027; says both flaws fixed in 9.4.0.029.
- GBHackersSays ESG builds before 9.4.0.030 are affected; no active exploitation observed.
- Cyber Security NewsCites patches BNSF-40425 and BNSF-40430; injection spans six product families.
- The Hacker NewsNovember 6 report says experts demonstrated root access without login.
- Vendors
- BarracudaBarracuda Networks
- Products
- Email Security GatewayLoad Balancer Application Delivery ControllerMessage ArchiverWAF Control CenterWeb Application FirewallWeb Security GatewayEmail Security Gateway (ESG)Load Balancer ADCMessage Archiver (BMA)WAF Control Center (WCC)Web Application Firewall (WAF)Web Security Gateway (WSG)
Coverage
oldest first · one row per article · UTC- · 6d ago
BleepingComputerFirst report
Barracuda critical flaws allow root access to devices
Two critical vulnerabilities in Barracuda ESG and related products could enable root access; patches released for affected versions.
- · 6d ago
The Hacker News
Barracuda flaws chained to bypass authorization and gain root access
Chaining the two vulnerabilities allows root access if the admin interface is accessible; restrict admin exposure to internal networks and update firmware.
- · 5d ago
CSO Online
Barracuda security appliances hit by two critical vulnerabilities
Patches released for CVE-2026-116606 authorization bypass and CVE-2026-111560 command injection in Barracuda Email Security Gateway and other products.
- · 5d ago
GBHackers
Barracuda Email Security Gateway flaws expose devices to root compromise
CVE-2026-116606 and CVE-2026-111560 could enable root access on ESG appliances.
- · 5d ago
Cyber Security News
Barracuda discloses authorization bypass and command injection flaws
Barracuda patched CVE-2026-116606 and CVE-2026-111560 which together could allow root access to affected appliances when exploited with administrative interface access.
- · 5d ago
SecurityWeek
Barracuda ESG Authentication Bypass Flaw Opens Path to Root
Patching required for chained authentication bypass and command injection flaws in Barracuda products.
- · 4d ago
Security Affairs
Barracuda patches two chained flaws for root access
Barracuda released patches for CVE-2026-116606 and CVE-2026-111560 in ESG appliances that can be combined to grant attackers full root access.
- · 3d ago
watchTowr Labs
Barracuda Email Security Gateway Pre-Auth RCE Discovered
Chained CVE-2026-116606 and CVE-2026-111560 enable pre-auth remote root code execution on Barracuda ESG 9.4.0.027.
- · 3d ago
Barracuda Email Security Gateway flaws enable root access without login
Two flaws chained allow root command execution without login; patches released for affected products.
Vulnerabilities in this story
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-111560 | Command Injection in Barracuda Appliance Timezone Field | 8.6 | — | ||
| CVE-2026-116606 | Auth bypass in Barracuda Email Security Gateway before 9.4.0.030 | 9.3 | — |