Security Intelligence
Loading table of contents...
At a glance:
-
Two vulnerabilities can be chained on Barracuda Email Security Gateway (ESG) to obtain root access to the appliance.
-
Root access to an ESG appliance provides control of a trusted security device positioned directly in the organization's email infrastructure.
-
Prioritize patching affected Barracuda Networks appliances, especially ESG systems, and review administrative access controls and appliance activity for indications of unauthorized access or exploitation.
Threat summary
On November 2, 2026, Barracuda Networks addressed two vulnerabilities, CVE-2026-116606 and CVE-2026-111560, affecting several of its security appliances. Email Security Gateway (ESG) is listed as the only affected product impacted by both vulnerabilities, allowing the flaws to be chained to bypass authorization controls and obtain root access to the appliance.
Barracuda ESG is an on-premises appliance, physical or virtual, that sits between the internet and an organization’s mail server and inspects all inbound and outbound email before delivery. It blocks spam, phishing, malware, and malicious attachments and links, and it enforces outbound policies such as data loss prevention and encryption.
Barracuda describes CVE-2026-116606 as a pre-authentication authorization bypass. Mandiant provided a separate analysis describing it as an authentication bypass vulnerability that affects the functionality in ESG that allows administrators to import and restore appliance configuration backups. A remote threat actor can invoke the configuration import feature and restore a crafted compatible backup archive, resulting in modification of the appliance's global configuration. The vulnerability affects ESG versions prior to 9.4.0.030 and has a CVSS score of 9.3.
The second vulnerability, CVE-2026-111560, is described as a command injection vulnerability affecting ESG, Load Balancer Application Delivery Controller (ADC), Web Application Firewall (WAF), Web Security Gateway (WSG), Message Archiver (BMA), and WAF Control Center (WCC). The vulnerability has a CVSS score of 8.6.
On ESG appliances, the vulnerabilities can form an attack chain. Barracuda Networks states that successful exploitation requires access to the administrative interface of an affected product. If combined, the vulnerabilities can bypass authorization controls and result in root access to the appliance. The advisory also identifies user interaction as not required for either vulnerability.
Analysis
Although no exploitation has been reported in this case, ESG appliances have previously been targeted by sophisticated threat actors. In 2023, a threat actor group known as UNC4841 exploited a different ESG vulnerability for months to compromise appliances and steal data.
ESG appliances occupy a privileged position within email infrastructure, and root access to an ESG appliance therefore gives an adversary complete control of a trusted security device that sits directly in the organization's email path.
Since exploitation requires access to the administrative interface of an affected product, exposure depends on how administrative access is managed. ESG appliances whose administrative interfaces are reachable by a broader set of users or networks present greater exposure than systems where management access is restricted to dedicated administrative networks.
The downstream impact depends on how the ESG is deployed. In environments where the appliance has visibility into sensitive email traffic, authentication systems, administrative networks, or other critical infrastructure, compromise could create opportunities for credential theft, email interception, lateral movement, or additional access into the environment.
Mitigations
Identify affected Barracuda appliances and prioritize patching ESG systems. Applying updates that address both CVE-2026-116606 and CVE-2026-111560 removes the documented path to root access. Appliances running older firmware versions may require multiple upgrade steps before reaching a fixed release.
Review whether ESG administrative interfaces are accessible beyond authorized administrators and management networks. Where an ESG management interface was exposed before patching, review administrative access logs, configuration restoration activity, and configuration changes for unexpected behavior. This helps identify attempts to abuse the authorization bypass vulnerability or establish privileged access on the appliance.
Where compromise is suspected, review credentials, keys, and appliance-level accounts accessible from the device. Replacing potentially exposed credentials can reduce the value of information obtained through appliance compromise.
Restrict administrative access to trusted management networks. Limiting access to management interfaces reduces the number of users and systems capable of reaching the vulnerable functionality involved in the attack chain.
Verify that all of the affected appliances have received the appropriate Barracuda security updates. Barracuda notes that systems running significantly older firmware may require more than one update before reaching a patched version.
Stay on top of emerging threats like this.
Sign up to receive a weekly roundup of our security intelligence feed. You'll be the first to know of emerging attack vectors, threats, and vulnerabilities.
