Barracuda Email Security Gateway Authentication Bypass Opens Path to Root
Barracuda has released patches for two vulnerabilities that can be chained to gain root access to its Email Security Gateway (ESG) appliances.
The first, tracked as CVE-2026-116606 (CVSS score of 9.3), is an authentication bypass that affects only ESG. The second, CVE-2026-111560 (CVSS score of 8.6), is a command injection issue that also impacts five other Barracuda products.
“An authentication bypass in Barracuda Email Security Gateway versions earlier than 9.4.0.030 allows an unauthenticated remote attacker to invoke a configuration-import function and restore a crafted, compatible backup archive, resulting in unauthorized modification of the appliance’s global configuration,” Mandiant explains in an advisory describing CVE-2026-116606.
The command injection bug sits in the timezone configuration setting, in code shared across several Barracuda products. Mandiant says an attacker logged in with administrator privileges could abuse it to execute OS commands as root.
“If exploited in combination, these vulnerabilities could allow an attacker to bypass...
Copyright of this story solely belongs to www.securityweek.com. To see the full text click HERE
