Barracuda ESG and Product Flaws Enable Unauthenticated Root Access
Barracuda has released patches for two significant vulnerabilities in its Email Security Gateway (ESG) appliances and other products. When chained, these flaws — an authentication bypass (CVE-2026-116606) and a command injection (CVE-2026-111560) — could allow an unauthenticated remote attacker to gain root access to affected ESG devices. While Barracuda advises administrative access is required for both bugs, Mandiant’s advisory clarifies that the ESG authentication bypass can be exploited without prior authentication, making the chain particularly dangerous, as reported by SecurityWeek.
Technical Analysis of the Vulnerabilities
The primary concern for Barracuda ESG customers is the Barracuda ESG authentication bypass CVE-2026-116606. This vulnerability, rated with a CVSS score of 9.3, specifically impacts Barracuda Email Security Gateway versions earlier than 9.4.0.030. According to Mandiant, this pre-authentication flaw allows an unauthenticated remote attacker to invoke a configuration-import function. By leveraging this, an attacker can restore a specially crafted, compatible backup archive, leading to unauthorized modification of the appliance’s global configuration. This capability is critical as it sets the stage for the second vulnerability.
The second vulnerability, CVE-2026-111560, is a command injection issue with a CVSS score of 8.6. This flaw resides within the timezone configuration setting, a piece of code shared across several Barracuda products. Mandiant notes that an attacker, once logged in with administrator privileges, could exploit this to execute operating system commands as root. The critical aspect of the vulnerability chain is that CVE-2026-116606 can grant those initial administrative privileges, thereby circumventing the authentication requirement for the command injection.
Affected Products and Impact
Beyond the Email Security Gateway, the command injection flaw (CVE-2026-111560) also affects a range of other Barracuda products, including:
- Load Balancer Application Delivery Controller (ADC)
- Message Archiver
- WAF Control Center
- Web Application Firewall (WAF)
- Web Security Gateway (WSG)
Barracuda stated that, if exploited in combination, these vulnerabilities could allow an attacker to bypass authorization controls and obtain root access to the device. While the advisories do not confirm in-the-wild exploitation for these specific flaws, the severity of unauthenticated root access should prompt immediate action from all affected organizations. It is also important to remember that ESG appliances have been targeted by sophisticated actors in the past, including Chinese cyberspies exploiting a zero-day (CVE-2023-2868) in October 2022, which led to device replacement recommendations.
Prioritizing Mitigation: How to Mitigate Barracuda Command Injection and Authentication Bypass
Defenders should prioritize immediate action to secure their Barracuda deployments. Here are the key recommendations:
- Update Firmware Immediately: Barracuda advises customers to update to the newest firmware, specifically ESG versions to 9.4.0.030 or later. Ensure all available patches are installed. If automatic patching is disabled, it should be re-enabled, and any non-automatically applied patches should be manually installed.
- Restrict Administrative Interface Access: Barracuda explicitly states that attackers must be able to reach an appliance’s admin interface to exploit these flaws. Organizations should rigorously restrict access to these interfaces, making them reachable only from trusted internal networks. This significantly reduces the attack surface for vulnerabilities like this Barracuda Email Security Gateway root access vulnerability.
- Review Logs and Configurations: Post-patching, conduct a thorough review of appliance logs and configurations for any signs of compromise or unauthorized changes, especially if the administrative interface was publicly exposed. Organizations should be vigilant for any anomalies that might indicate previous exploitation attempts or successful breaches.
These vulnerabilities underscore the importance of continuous patching and network segmentation, especially for internet-facing security appliances that act as critical gateways for an organization’s communications.
Related: miniOrange SAML SSO Auth Bypass Exploited in WordPress Attacks, Microsoft & Apple Patch Critical RCEs and Auth Bypass Flaws