Overview
- This week Barracuda published advisories and released fixes for two tracked vulnerabilities: CVE-2026-116606, an Email Security Gateway authentication bypass rated CVSS 9.3, and CVE-2026-111560, a timezone-related command-injection bug rated CVSS 8.6.
- Security researchers and Barracuda say the two bugs can be chained so an attacker can bypass authorization controls and execute commands as root on affected appliances.
- The command-injection flaw affects six Barracuda products including ESG, Load Balancer ADC, Message Archiver, WAF Control Center, Web Application Firewall, and Web Security Gateway while the auth bypass affects ESG versions earlier than 9.4.0.030.
- Barracuda and Mandiant advise that exploitation generally requires access to an appliance’s administrative interface and recommend installing the released firmware updates, re-enabling automatic patching if disabled, and restricting admin interfaces to trusted internal networks.
- There is no public confirmation these specific flaws have been exploited in the wild and customers should recall that ESG devices were previously targeted in 2022–2023 by the UNC4841 group, a history that raises urgency for rapid patching and account reviews.