Barracuda ESG Authentication Bypass Flaw Opens Path to Root

Barracuda has patched two vulnerabilities that can be chained to gain root access to its Email Security Gateway (ESG) appliances. Update to the newest firmware, confirm every patch is installed, and keep the admin interface off untrusted networks.

What happened

According to SecurityWeek, Barracuda fixed two bugs. They can be chained to reach root.

The first is CVE-2026-116606, with a CVSS score of 9.3. It is an authentication bypass that affects only ESG. Mandiant says an unauthenticated remote attacker can invoke a configuration-import function and restore a crafted, compatible backup archive. The result is unauthorized modification of the appliance's global configuration.

The second is CVE-2026-111560, with a CVSS score of 8.6. It is a command injection issue in the timezone configuration setting, in code shared across several Barracuda products. Mandiant says an attacker logged in with administrator privileges could use it to run OS commands as root.

Barracuda sums up the chain this way: if exploited in combination, the flaws "could allow an attacker to bypass authorization controls and obtain root access to the device."

Who is affected

The authentication bypass hits ESG only. The command injection also affects five other Barracuda products.

If you run any of these products, treat the update as in scope, not just ESG.

How serious it is

The 9.3 score on the authentication bypass is in the critical range. The 8.6 on the command injection is high. Chained, they end in root on a device that sits in your mail path.

Barracuda says attackers must be able to reach the appliance's admin interface. That limits the risk, but only if your interface is truly private.

The vendor advisory is a bit mixed. Barracuda marks administrative access as required for both bugs, yet also calls CVE-2026-116606 a pre-authentication issue. Mandiant, which published advisories for both flaws, says the ESG bug can be exploited without authentication. Plan for the worse reading.

Mandiant says Barracuda reported the command injection on October 15 and the authentication bypass on October 22. Exploitation in the wild is not confirmed in either advisory, so check the Barracuda and Mandiant advisories for updates.

There is history here. Chinese cyberspies exploited an earlier ESG zero-day, CVE-2023-2868, starting in October 2022. That campaign led Barracuda to tell customers to replace compromised devices.

What to do now

1. Patch and confirm

1. Update to the newest firmware.

2. Confirm every available patch is installed.

3. Install any patch that was not applied automatically, by hand.

4. If automatic patching is disabled, switch it back on.

2. Check who can reach the admin interface

Barracuda advises keeping admin interfaces reachable only from trusted internal networks. Test that from a host outside your management network. Replace the placeholders with your appliance address and admin port.

nmap -Pn -p <admin-port> <appliance-address>
curl -k -I --max-time 10 https://<appliance-address>:<admin-port>/

If either command connects from the internet or a user VLAN, tighten the firewall rule so only your management subnet can reach it. Then rerun the test.

3. Prioritize with a quick decision table

4. Worked example

Say you manage one ESG and one WAF. Run the reachability test against both from a guest Wi-Fi laptop. If the WAF admin page answers, you have found a gap before an attacker did. Close it first, then update both devices.

What IT and security learners can take from it

This case shows how a configuration bypass and an admin-only command injection combine into unauthenticated root. It also shows why admin interfaces belong on a management network, not the open internet. Concepts like attack chaining, exposure management and patch verification are core topics in the Cybersecurity certification category. If you want a hands-on analyst path, the CompTIA CySA+ CS0-003 voucher ($224.99) covers vulnerability management and response. For a similar bypass story, see our Cisco ISE authorization bypass fix guide.

Patch first, then study the pattern. Vouchers are delivered by email within 12 hours.

Sources

• Barracuda ESG Authentication Bypass Flaw Opens Path to Root (SecurityWeek)