Barracuda Networks has addressed two critical security flaws in its Email Security Gateway (ESG) devices that could allow attackers to gain root access. These vulnerabilities are identified as CVE-2026-116606, an authentication bypass, and CVE-2026-111560, a command injection flaw.
Details of the Vulnerabilities
The first flaw, CVE-2026-116606, scores a high critical rating of 9.3 on the CVSS scale. This vulnerability specifically impacts the ESG by permitting unauthorized remote attackers to manipulate the global configuration through a crafted backup archive. The second issue, CVE-2026-111560, with a CVSS score of 8.6, involves a command injection vulnerability within the timezone configuration code, affecting multiple Barracuda products beyond just ESG.
Potential Impact on Other Devices
The command injection vulnerability spreads across Barracuda’s product line, including the Load Balancer Application Delivery Controller (ADC), Message Archiver, and Web Application Firewall (WAF), among others. If both vulnerabilities are exploited together, attackers could potentially bypass security controls and execute commands as root, posing severe risks to affected systems.
Recommended Actions for Users
Barracuda advises users to ensure their devices are updated with the latest firmware to mitigate these risks. The company emphasizes the importance of keeping administrative interfaces accessible only from trusted networks to prevent unauthorized exploitation. It is crucial that all available patches are applied, especially for devices with automatic updates disabled.
Users are urged to verify that all updates have been installed, given that the command injection flaw was disclosed on October 15, and the authentication bypass on October 22. There has been no confirmation of these vulnerabilities being exploited in the wild, yet previous incidents, such as the October 2022 attack on ESG appliances by Chinese hackers, underscore the importance of timely updates.
For further protection, organizations should review their security protocols and ensure compliance with Barracuda’s guidance to prevent potential breaches.
