Vulnerability Details
Barracuda has announced the release of software patches to address two security vulnerabilities in Email Security Gateway (ESG) appliances, where these two vulnerabilities can be exploited sequentially to obtain full access (Root) to the affected devices.
The first vulnerability, identified as CVE-2026-116606, involves an authentication bypass and exclusively affects ESG appliances, allowing an unauthenticated attacker to call the settings import function and restore a modified backup archive, leading to unauthorized modification of the device's global settings. This vulnerability received a severity rating of 9.3 on the CVSS scale.
The second vulnerability, identified as CVE-2026-111560, is a command injection vulnerability located in the time zone settings, affecting ESG appliances as well as five other Barracuda products, including Application Delivery Controllers (ADC) and Web Application Firewalls (WAF). This vulnerability, which received a rating of 8.6, allows users with administrator privileges to execute operating system commands with root privileges.
Why Does This News Matter?
The danger lies in the possibility of combining these two vulnerabilities, granting attackers the ability to bypass authorization controls and gain full control over the device. Since email security appliances act as the first line of defense in organizations, their compromise opens the door to large-scale security threats, including espionage or interception of sensitive communications.
What Should Users Do?
Barracuda recommends all customers take the following steps immediately:
- Update devices to the latest firmware version and ensure all available patches are installed.
- Enable automatic updates if they are disabled, and ensure any patch that was not applied automatically is installed manually.
- Restrict access to device management interfaces to trusted internal networks only to reduce the attack surface.
It is worth noting that Mandiant, which contributed to the discovery of these vulnerabilities, indicated that the authentication bypass vulnerability in ESG can be exploited without the need for credentials, making it a top priority for patching.