Barracuda is telling customers to patch two bugs that together can give an attacker root on its appliances.
- CVE-2026-116606 (critical): an Email Security Gateway authentication weakness that lets an attacker change the appliance’s global config.
- CVE-2026-111560: an admin-level OS command injection that runs as root.
- Both need access to the admin interface. Chained, they bypass authorization and get root.
- Patches are out. Barracuda has a list of affected products and fixed firmware.
My take
Barracuda ESG has history here. Back in 2023, Chinese attackers used ESG zero-days for months. The fix is out, so patch, but the real fix is the same as always: management interfaces belong on a management network, never on the internet. If your admin UI is reachable from outside, that’s the first thing I’d change.
God Bless, and May the Source Be with You!
