Critical Authentication Bypass & Command Injection in Barracuda Email Security Gateway (CVE‑2026‑116606, CVE‑2026‑111560) Enable Full Root Access
What It Is — Barracuda Networks disclosed two high‑severity flaws affecting its Email Security Gateway (ESG) appliance family.
- CVE‑2026‑116606 (CVSS 9.3) is a pre‑authentication authorization bypass that lets unauthenticated actors modify appliance configuration.
- CVE‑2026‑111560 (CVSS 8.6) is a command‑injection vulnerability present in six Barracuda products; when exploited by an attacker who already has administrative access, it permits execution of arbitrary OS commands as root.
When chained, the bypass can be used to reach the administrative interface, and the injection then grants full system‑level privileges. The vulnerabilities are in‑the‑wild and have been assigned CVE identifiers. Barracuda released firmware patches for all affected models and recommends immediate remediation.
Affected Products – Barracuda Email Security Gateway (ESG) – both CVEs; Load Balancer ADC, Message Archiver (BMA), WAF Control Center (WCC), Web Application Firewall (WAF), and Web Security Gateway (WSG) – CVE‑2026‑111560 only.
Why It Matters for Trust & Control Assurance – The chain tests the control objective of restricting and monitoring privileged administrative interfaces; a lapse directly undermines access‑control assurance across frameworks such as NIST CSF 2.0.
Recommended Actions –
- Verify the appliance firmware version; apply the appropriate patches (BNSF‑40425/‑40430 for ESG, BNADC‑16586, BNMA‑32468, BNWF‑60060, BNYF‑24789 for other models).
- Limit administrative UI access to trusted internal networks and enforce network‑level segmentation.
- Enable logging of all privileged‑interface activity and integrate logs with a SIEM for continuous monitoring.
- Conduct a post‑patch validation to confirm the bypass and injection vectors are mitigated.
Source: Security Affairs – Two Barracuda ESG Flaws Could Be Combined for Full Root Access; Patches Released