Barracuda ESG Authentication Bypass Flaw Opens Path to Root

Barracuda has shipped fixes for two flaws that, used together, let an attacker take full root control of its Email Security Gateway (ESG) appliances. The more severe bug, CVE-2026-116606 (CVSS 9.3), is an authentication bypass unique to ESG versions before 9.4.0.030, which Mandiant says lets an unauthenticated attacker trigger a configuration-restore function to upload a malicious backup and alter the device's global settings. The second issue, CVE-2026-111560 (CVSS 8.6), is a command-injection flaw in shared timezone-configuration code that also hits Load Balancer ADC, Message Archiver, WAF Control Center, WAF, and WSG products, allowing an already-authenticated admin to run OS commands as root. Barracuda states admin-panel access is needed to exploit either bug and recommends restricting management interfaces to trusted networks, while urging customers to confirm the latest firmware and all patches are applied, re-enabling automatic updates where disabled; neither vendor nor Mandiant confirms active exploitation yet, though ESG devices were previously targeted in a 2022 Chinese espionage campaign abusing a separate zero-day, CVE-2023-2868.