Barracuda patches two chainable ESG flaws enabling root access

Key points

• Two Barracuda ESG vulnerabilities were fixed: CVE-2026-116606 and CVE-2026-111560.
• Attackers need no credentials and can chain the flaws together.
• Successful exploitation can yield root-level control and configuration changes.
• Any exposed ESG appliance should be patched and reviewed for tampering.

Barracuda has released fixes for two security defects in its Email Security Gateway (ESG) product line. Tracked as CVE-2026-116606 and CVE-2026-111560, the issues matter because they can be used together by someone with no account on the appliance. The vendor addressed both flaws; administrators should treat the update as urgent rather than routine.

The exposure is not limited to one tenant or integration. It applies to ESG appliances, the mail-filtering systems that sit in front of many organizations' email. Because those systems inspect inbound and outbound mail, a compromised gateway can become a vantage point for further abuse. The two flaws include an authentication bypass and a path to change configuration; when combined, they can lead to root-level control of the appliance.

Chainable bugs are more dangerous than isolated ones. An unauthenticated attacker can use the first weakness to get past login controls, then use the second to modify settings or elevate privileges. Root access on an email gateway can expose message flow, allow rule changes, and undermine trust in mail security. Configuration modification could also redirect, retain, or suppress mail, depending on how the device is deployed.

Barracuda has patched the flaws, but patching is only the first step. Organizations running ESG appliances should inventory internet-facing management interfaces, confirm firmware versions, and look for unexpected admin accounts, altered policies, or new routes. Since exploitation may leave little obvious trace, review logs around the patch window and compare current configuration against known-good baselines. Watch for scanning activity targeting ESG endpoints and for reports of chained exploitation in the wild.

What to do now

1. Identify every ESG appliance and record its firmware/build; prioritize internet-exposed management interfaces.
2. Apply Barracuda's updates for CVE-2026-116606 and CVE-2026-111560 immediately; reboot if required.
3. Restrict administrative access to trusted networks or VPN; disable external management where possible.
4. Rotate credentials and API keys used by the appliance and integrated services.
5. Compare configuration against a known-good baseline; look for new admin users, mail rules, relays, or logging changes.
6. Review logs for unauthenticated probes, login anomalies, and configuration changes before and after patching.
7. If compromise indicators appear, isolate the appliance, preserve evidence, and escalate to incident response.

CVE references

• CVE-2026-116606
• CVE-2026-111560

Original source

Security Affairs