Barracuda ESG Authentication Bypass Flaw Opens Path to Root

Hi, what are you looking for?

An authentication bypass and a command injection flaw can be chained for root access on Barracuda’s Email Security Gateway appliances.

By

Flipboard

Reddit

Whatsapp

Whatsapp

Email

Barracuda has released patches for two vulnerabilities that can be chained to gain root access to its Email Security Gateway (ESG) appliances.The first, tracked as CVE-2026-116606 (CVSS score of 9.3), is an authentication bypass that affects only ESG. The second, CVE-2026-111560 (CVSS score of 8.6), is a command injection issue that also impacts five other Barracuda products.“An authentication bypass in Barracuda Email Security Gateway versions earlier than 9.4.0.030 allows an unauthenticated remote attacker to invoke a configuration-import function and restore a crafted, compatible backup archive, resulting in unauthorized modification of the appliance’s global configuration,” Mandiant explains in anadvisorydescribing CVE-2026-116606.The command injection bug sits in the timezone configuration setting, in code shared across several Barracuda products. Mandiant says an attacker logged in with administrator privileges could abuse it to execute OS commands as root.“If exploited in combination, these vulnerabilities could allow an attacker to bypass authorization controls and obtain root access to the device,”Barracuda says.In addition to ESG, the command injection flaw affects the Load Balancer Application Delivery Controller (ADC), Message Archiver, WAF Control Center, Web Application Firewall (WAF), and Web Security Gateway (WSG).Advertisement. Scroll to continue reading.According to Barracuda, attackers must be able to reach an appliance’s admin interface to exploit the flaws. The company advises organizations to keep these interfaces reachable only from trusted internal networks.Barracuda’s advisory marks administrative access as required for both bugs, yet also calls CVE-2026-116606 a pre-authentication issue. Mandiant, which publishedadvisoriesfor both flaws, says the ESG bug can be exploited without authentication.Customers are advised to update to the newest firmware and confirm that every available patch is installed. Barracuda says any patch not applied automatically should be manually installed, and that devices with automatic patching disabled should have it switched back on.According to Mandiant, Barracuda reported the command injection on October 15 and the authentication bypass on October 22. Neither advisory says whether the flaws have been exploited in the wild.ESG appliances were previously targeted by Chinese cyberspies whoexploited a zero-day, CVE-2023-2868, starting in October 2022. That campaign led Barracuda to tell customers to replace compromised devices.Related:Critical Node-RED Flaw Exploited in AttacksRelated:Ivanti Patches Two More Zero-Days Exploited in Connect Secure Attack ChainRelated:Drupal Commerce Core Vulnerability Exploited Against Online Stores

The first, tracked as CVE-2026-116606 (CVSS score of 9.3), is an authentication bypass that affects only ESG. The second, CVE-2026-111560 (CVSS score of 8.6), is a command injection issue that also impacts five other Barracuda products.“An authentication bypass in Barracuda Email Security Gateway versions earlier than 9.4.0.030 allows an unauthenticated remote attacker to invoke a configuration-import function and restore a crafted, compatible backup archive, resulting in unauthorized modification of the appliance’s global configuration,” Mandiant explains in anadvisorydescribing CVE-2026-116606.The command injection bug sits in the timezone configuration setting, in code shared across several Barracuda products. Mandiant says an attacker logged in with administrator privileges could abuse it to execute OS commands as root.“If exploited in combination, these vulnerabilities could allow an attacker to bypass authorization controls and obtain root access to the device,”Barracuda says.In addition to ESG, the command injection flaw affects the Load Balancer Application Delivery Controller (ADC), Message Archiver, WAF Control Center, Web Application Firewall (WAF), and Web Security Gateway (WSG).Advertisement. Scroll to continue reading.According to Barracuda, attackers must be able to reach an appliance’s admin interface to exploit the flaws. The company advises organizations to keep these interfaces reachable only from trusted internal networks.Barracuda’s advisory marks administrative access as required for both bugs, yet also calls CVE-2026-116606 a pre-authentication issue. Mandiant, which publishedadvisoriesfor both flaws, says the ESG bug can be exploited without authentication.Customers are advised to update to the newest firmware and confirm that every available patch is installed. Barracuda says any patch not applied automatically should be manually installed, and that devices with automatic patching disabled should have it switched back on.According to Mandiant, Barracuda reported the command injection on October 15 and the authentication bypass on October 22. Neither advisory says whether the flaws have been exploited in the wild.ESG appliances were previously targeted by Chinese cyberspies whoexploited a zero-day, CVE-2023-2868, starting in October 2022. That campaign led Barracuda to tell customers to replace compromised devices.Related:Critical Node-RED Flaw Exploited in AttacksRelated:Ivanti Patches Two More Zero-Days Exploited in Connect Secure Attack ChainRelated:Drupal Commerce Core Vulnerability Exploited Against Online Stores

“An authentication bypass in Barracuda Email Security Gateway versions earlier than 9.4.0.030 allows an unauthenticated remote attacker to invoke a configuration-import function and restore a crafted, compatible backup archive, resulting in unauthorized modification of the appliance’s global configuration,” Mandiant explains in anadvisorydescribing CVE-2026-116606.The command injection bug sits in the timezone configuration setting, in code shared across several Barracuda products. Mandiant says an attacker logged in with administrator privileges could abuse it to execute OS commands as root.“If exploited in combination, these vulnerabilities could allow an attacker to bypass authorization controls and obtain root access to the device,”Barracuda says.In addition to ESG, the command injection flaw affects the Load Balancer Application Delivery Controller (ADC), Message Archiver, WAF Control Center, Web Application Firewall (WAF), and Web Security Gateway (WSG).Advertisement. Scroll to continue reading.According to Barracuda, attackers must be able to reach an appliance’s admin interface to exploit the flaws. The company advises organizations to keep these interfaces reachable only from trusted internal networks.Barracuda’s advisory marks administrative access as required for both bugs, yet also calls CVE-2026-116606 a pre-authentication issue. Mandiant, which publishedadvisoriesfor both flaws, says the ESG bug can be exploited without authentication.Customers are advised to update to the newest firmware and confirm that every available patch is installed. Barracuda says any patch not applied automatically should be manually installed, and that devices with automatic patching disabled should have it switched back on.According to Mandiant, Barracuda reported the command injection on October 15 and the authentication bypass on October 22. Neither advisory says whether the flaws have been exploited in the wild.ESG appliances were previously targeted by Chinese cyberspies whoexploited a zero-day, CVE-2023-2868, starting in October 2022. That campaign led Barracuda to tell customers to replace compromised devices.Related:Critical Node-RED Flaw Exploited in AttacksRelated:Ivanti Patches Two More Zero-Days Exploited in Connect Secure Attack ChainRelated:Drupal Commerce Core Vulnerability Exploited Against Online Stores

The command injection bug sits in the timezone configuration setting, in code shared across several Barracuda products. Mandiant says an attacker logged in with administrator privileges could abuse it to execute OS commands as root.“If exploited in combination, these vulnerabilities could allow an attacker to bypass authorization controls and obtain root access to the device,”Barracuda says.In addition to ESG, the command injection flaw affects the Load Balancer Application Delivery Controller (ADC), Message Archiver, WAF Control Center, Web Application Firewall (WAF), and Web Security Gateway (WSG).Advertisement. Scroll to continue reading.According to Barracuda, attackers must be able to reach an appliance’s admin interface to exploit the flaws. The company advises organizations to keep these interfaces reachable only from trusted internal networks.Barracuda’s advisory marks administrative access as required for both bugs, yet also calls CVE-2026-116606 a pre-authentication issue. Mandiant, which publishedadvisoriesfor both flaws, says the ESG bug can be exploited without authentication.Customers are advised to update to the newest firmware and confirm that every available patch is installed. Barracuda says any patch not applied automatically should be manually installed, and that devices with automatic patching disabled should have it switched back on.According to Mandiant, Barracuda reported the command injection on October 15 and the authentication bypass on October 22. Neither advisory says whether the flaws have been exploited in the wild.ESG appliances were previously targeted by Chinese cyberspies whoexploited a zero-day, CVE-2023-2868, starting in October 2022. That campaign led Barracuda to tell customers to replace compromised devices.Related:Critical Node-RED Flaw Exploited in AttacksRelated:Ivanti Patches Two More Zero-Days Exploited in Connect Secure Attack ChainRelated:Drupal Commerce Core Vulnerability Exploited Against Online Stores

“If exploited in combination, these vulnerabilities could allow an attacker to bypass authorization controls and obtain root access to the device,”Barracuda says.In addition to ESG, the command injection flaw affects the Load Balancer Application Delivery Controller (ADC), Message Archiver, WAF Control Center, Web Application Firewall (WAF), and Web Security Gateway (WSG).Advertisement. Scroll to continue reading.According to Barracuda, attackers must be able to reach an appliance’s admin interface to exploit the flaws. The company advises organizations to keep these interfaces reachable only from trusted internal networks.Barracuda’s advisory marks administrative access as required for both bugs, yet also calls CVE-2026-116606 a pre-authentication issue. Mandiant, which publishedadvisoriesfor both flaws, says the ESG bug can be exploited without authentication.Customers are advised to update to the newest firmware and confirm that every available patch is installed. Barracuda says any patch not applied automatically should be manually installed, and that devices with automatic patching disabled should have it switched back on.According to Mandiant, Barracuda reported the command injection on October 15 and the authentication bypass on October 22. Neither advisory says whether the flaws have been exploited in the wild.ESG appliances were previously targeted by Chinese cyberspies whoexploited a zero-day, CVE-2023-2868, starting in October 2022. That campaign led Barracuda to tell customers to replace compromised devices.Related:Critical Node-RED Flaw Exploited in AttacksRelated:Ivanti Patches Two More Zero-Days Exploited in Connect Secure Attack ChainRelated:Drupal Commerce Core Vulnerability Exploited Against Online Stores

In addition to ESG, the command injection flaw affects the Load Balancer Application Delivery Controller (ADC), Message Archiver, WAF Control Center, Web Application Firewall (WAF), and Web Security Gateway (WSG).Advertisement. Scroll to continue reading.According to Barracuda, attackers must be able to reach an appliance’s admin interface to exploit the flaws. The company advises organizations to keep these interfaces reachable only from trusted internal networks.Barracuda’s advisory marks administrative access as required for both bugs, yet also calls CVE-2026-116606 a pre-authentication issue. Mandiant, which publishedadvisoriesfor both flaws, says the ESG bug can be exploited without authentication.Customers are advised to update to the newest firmware and confirm that every available patch is installed. Barracuda says any patch not applied automatically should be manually installed, and that devices with automatic patching disabled should have it switched back on.According to Mandiant, Barracuda reported the command injection on October 15 and the authentication bypass on October 22. Neither advisory says whether the flaws have been exploited in the wild.ESG appliances were previously targeted by Chinese cyberspies whoexploited a zero-day, CVE-2023-2868, starting in October 2022. That campaign led Barracuda to tell customers to replace compromised devices.Related:Critical Node-RED Flaw Exploited in AttacksRelated:Ivanti Patches Two More Zero-Days Exploited in Connect Secure Attack ChainRelated:Drupal Commerce Core Vulnerability Exploited Against Online Stores

According to Barracuda, attackers must be able to reach an appliance’s admin interface to exploit the flaws. The company advises organizations to keep these interfaces reachable only from trusted internal networks.Barracuda’s advisory marks administrative access as required for both bugs, yet also calls CVE-2026-116606 a pre-authentication issue. Mandiant, which publishedadvisoriesfor both flaws, says the ESG bug can be exploited without authentication.Customers are advised to update to the newest firmware and confirm that every available patch is installed. Barracuda says any patch not applied automatically should be manually installed, and that devices with automatic patching disabled should have it switched back on.According to Mandiant, Barracuda reported the command injection on October 15 and the authentication bypass on October 22. Neither advisory says whether the flaws have been exploited in the wild.ESG appliances were previously targeted by Chinese cyberspies whoexploited a zero-day, CVE-2023-2868, starting in October 2022. That campaign led Barracuda to tell customers to replace compromised devices.Related:Critical Node-RED Flaw Exploited in AttacksRelated:Ivanti Patches Two More Zero-Days Exploited in Connect Secure Attack ChainRelated:Drupal Commerce Core Vulnerability Exploited Against Online Stores

Barracuda’s advisory marks administrative access as required for both bugs, yet also calls CVE-2026-116606 a pre-authentication issue. Mandiant, which publishedadvisoriesfor both flaws, says the ESG bug can be exploited without authentication.Customers are advised to update to the newest firmware and confirm that every available patch is installed. Barracuda says any patch not applied automatically should be manually installed, and that devices with automatic patching disabled should have it switched back on.According to Mandiant, Barracuda reported the command injection on October 15 and the authentication bypass on October 22. Neither advisory says whether the flaws have been exploited in the wild.ESG appliances were previously targeted by Chinese cyberspies whoexploited a zero-day, CVE-2023-2868, starting in October 2022. That campaign led Barracuda to tell customers to replace compromised devices.Related:Critical Node-RED Flaw Exploited in AttacksRelated:Ivanti Patches Two More Zero-Days Exploited in Connect Secure Attack ChainRelated:Drupal Commerce Core Vulnerability Exploited Against Online Stores

Customers are advised to update to the newest firmware and confirm that every available patch is installed. Barracuda says any patch not applied automatically should be manually installed, and that devices with automatic patching disabled should have it switched back on.According to Mandiant, Barracuda reported the command injection on October 15 and the authentication bypass on October 22. Neither advisory says whether the flaws have been exploited in the wild.ESG appliances were previously targeted by Chinese cyberspies whoexploited a zero-day, CVE-2023-2868, starting in October 2022. That campaign led Barracuda to tell customers to replace compromised devices.Related:Critical Node-RED Flaw Exploited in AttacksRelated:Ivanti Patches Two More Zero-Days Exploited in Connect Secure Attack ChainRelated:Drupal Commerce Core Vulnerability Exploited Against Online Stores

According to Mandiant, Barracuda reported the command injection on October 15 and the authentication bypass on October 22. Neither advisory says whether the flaws have been exploited in the wild.ESG appliances were previously targeted by Chinese cyberspies whoexploited a zero-day, CVE-2023-2868, starting in October 2022. That campaign led Barracuda to tell customers to replace compromised devices.Related:Critical Node-RED Flaw Exploited in AttacksRelated:Ivanti Patches Two More Zero-Days Exploited in Connect Secure Attack ChainRelated:Drupal Commerce Core Vulnerability Exploited Against Online Stores

ESG appliances were previously targeted by Chinese cyberspies whoexploited a zero-day, CVE-2023-2868, starting in October 2022. That campaign led Barracuda to tell customers to replace compromised devices.Related:Critical Node-RED Flaw Exploited in AttacksRelated:Ivanti Patches Two More Zero-Days Exploited in Connect Secure Attack ChainRelated:Drupal Commerce Core Vulnerability Exploited Against Online Stores

Related:Critical Node-RED Flaw Exploited in AttacksRelated:Ivanti Patches Two More Zero-Days Exploited in Connect Secure Attack ChainRelated:Drupal Commerce Core Vulnerability Exploited Against Online Stores

Related:Ivanti Patches Two More Zero-Days Exploited in Connect Secure Attack ChainRelated:Drupal Commerce Core Vulnerability Exploited Against Online Stores

Related:Drupal Commerce Core Vulnerability Exploited Against Online Stores

Eduard Kovacs (@EduardKovacs) is senior managing editor at SecurityWeek. He worked as a high school IT teacher before starting a career in journalism in 2011. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Subscribe to the SecurityWeek Email Briefing for the latest cybersecurity threats, trends, and expert insights.

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Close the security gaps between pentests. Join this session to explore agentic pentesting and gain a practical framework for continuous exposure validation in your CTEM program.

Join as we bring together CISOs, senior cybersecurity executives, practitioners, industry experts, and other security leaders to share practical experience and examine the issues shaping enterprise cybersecurity strategy.

Rob T. Lee has joined Dragos as Chief AI Officer.

Barracuda has appointed Dan Fletcher as CFO.

Artemis Security has appointed Arun Singh as CGO.

As organizations eliminate passwords, attackers will adapt. Instead of attacking the authenticator directly, they will look for opportunities around it.(Torsten George)

Risk managers are trained to spot weak signals, plan for disruption and make hard decisions under uncertainty. But the discipline looks different when the risk is not a system or an enterprise, but you.(Steve Durbin)

The process that gates nearly every B2B deal is a self-assessment the sender distrusts and the receiver accepts. There is finally a better basis for trust between companies.(Sravish Sridhar)

Keep your patch management pipelines primed in case another round of Citrix NetScaler patches get released soon.(Tod Beardsley)

Where your developers sit on the AI adoption scale has a real impact on how you are addressing security risk.(Matias Madou)

Flipboard

Reddit

Whatsapp

Whatsapp

Email

Got a confidential news tip? We want to hear from you.

Reach a large audience of enterprise cybersecurity professionals

Subscribe to the SecurityWeek Daily Briefing and get the latest content delivered to your inbox.

Copyright © 2026 SecurityWeek ®, a Wired Business Media Publication. All Rights Reserved.