Barracuda Patches Critical Chain Granting Unauthenticated Root Access on Email Security Gateway
Barracuda has released patches for two vulnerabilities that can be chained to achieve unauthenticated root access on its Email Security Gateway (ESG). CVE-2026-116606 is a pre-authentication authorization bypass, while CVE-2026-111560 is an OS command injection flaw. According to watchTowr Labs, the authorization bypass allows attackers to trigger backup restore functions without valid credentials. This process executes a command injection vulnerability as root, enabling arbitrary code execution. Barracuda advises customers to update firmware immediately and restrict administrative interface access to trusted internal networks.
