Barracuda has released patches for two vulnerabilities in its Email Security Gateway (ESG) appliances that can be chained to bypass authorization controls and obtain root access, according to SecurityWeek’s report.
The first flaw, CVE-2026-116606, is an authentication bypass with a CVSS score of 9.3. It affects ESG versions earlier than 9.4.0.030 and can allow an unauthenticated remote attacker to invoke a configuration-import function and restore a crafted backup archive, Mandiant says, as reported by SecurityWeek. The second flaw, CVE-2026-111560, is a command-injection vulnerability rated 8.6 that affects ESG and five other Barracuda products.
Mandiant’s vulnerability advisory identifies CVE-2026-111560 as affecting ESG versions 9.4.0.27 and earlier, as well as specified versions of Barracuda’s ADC, WAF, WSG, Message Archiver and WAF Control Center products. An authenticated administrator can inject operating-system commands through the timezone configuration field; the commands execute with root privileges when the value is processed.
The exposure conditions need careful reading. SecurityWeek reports that Barracuda says attackers must be able to reach an appliance’s administrative interface, while Mandiant describes the command-injection flaw as requiring administrative authentication. The ESG authentication bypass is separately described as exploitable without authentication, creating the chain’s authorization-bypass component.
Barracuda advises customers to update to the newest firmware, verify that all available patches were installed, and re-enable automatic patching if it has been disabled. The cited advisories do not say whether either vulnerability has been exploited in the wild, so the current reporting establishes potential root-level impact—not confirmed compromise.