Overview
- Barracuda disclosed the two vulnerabilities and published fixes on Tuesday after finding they can be chained to bypass authorization and obtain root on affected appliances.
- The flaws are tracked as CVE-2026-116606, an Email Security Gateway authentication bypass that can modify global configuration, and CVE-2026-111560, a command-injection bug that can run OS commands as root.
- CVE-2026-116606 affects only the Email Security Gateway while CVE-2026-111560 impacts multiple products including Load Balancer ADC, Message Archiver, WAF Control Center, Web Application Firewall, and Web Security Gateway.
- Barracuda says a successful attack requires access to a device’s administrative interface so appliances with management ports exposed to the internet are at highest risk and some devices may need sequential firmware updates to reach the patched version.
- The company, which serves over 200,000 customers, urged immediate patching and network controls and noted the disclosure follows earlier exploited ESG zero-days in 2022–2023 that hit government and other organizations.