Barracuda ESG Authentication Bypass Flaw Opens Path to Root
Source SecurityWeek
Mentioned vulnerabilities
Fixed in 9.4.0.030 : patch affected systems soon.
Data as of 4 Nov 2026, 17:13 UTC
Rated High by Threat Radar's AI analysis
- Patch
- Available – fixed in 9.4.0.030
What to do
AI-suggested
Barracuda has released patches addressing both vulnerabilities. Organizations should update ESG appliances to the latest firmware version 9.4.0.030 or later and apply all available patches. Devices with automatic patching disabled should have it re-enabled or patches applied manually. Additionally, administrative interfaces should be restricted to trusted internal networks to reduce exposure. No other specific mitigations are indicated by the vendor.
Description
Two vulnerabilities in Barracuda Email Security Gateway (ESG) appliances can be chained to gain root access. The first is an authentication bypass (CVE-2026-116606) allowing unauthenticated attackers to restore crafted backups and modify global configuration. The second is a command injection flaw (CVE-2026-111560) in the timezone configuration, exploitable by authenticated administrators to execute OS commands as root. The command injection also affects five other Barracuda products. Exploitation requires access to the appliance's administrative interface. Barracuda has released patches and advises restricting admin interface access to trusted internal networks.