Covered by 2 outlets — first reported by SecurityWeek, Nov 4, 14:24 UTC
Barracuda ESG Authentication Bypass Flaw Opens Path to Root
Summary
Barracuda has patched two vulnerabilities in its Email Security Gateway appliances that can be chained to give an attacker full root control of the device. One is an authentication bypass, CVE-2026-116606 (CVSS 9.3), that lets unauthenticated attackers change appliance configuration; the other is a command injection flaw, CVE-2026-111560. Coverage of the fixes describes the two flaws as working together rather than separately.
AI summary by the SecurityTabs newsroom, checked against SecurityWeek, Security Affairs. Read the outlets below for the full story.
Continue reading
2 outlets, in the order they reported it.
SecurityWeekFirst report
Barracuda ESG Authentication Bypass Flaw Opens Path to Root
An authentication bypass and a command injection flaw can be chained for root access on Barracuda’s Email Security Gateway appliances.
Security Affairs
Two Barracuda ESG Flaws Could Be Combined for Full Root Access; Patches Released
Barracuda patched two flaws that can be chained to give attackers root access to Email Security Gateway appliances. Barracuda has patched two vulnerabilities that can be chained to gain root access to its Email Security Gateway (ESG)…
Explained
The technology and terms in this story. Learn more
- WeaknessAuthentication bypassA flaw that lets someone in without valid credentials.
- WeaknessCommand injectionGetting an application to run operating-system commands built from attacker input.
- ConceptCVSS · Common Vulnerability Scoring SystemA 0–10 score for how severe a vulnerability is in theory.
- ConceptCVE · Common Vulnerabilities and ExposuresThe public ID system for vulnerabilities, such as CVE-2026-12345, so everyone means the same bug.
Why it was possible
The weaknesses behind this story's CVEs, from each CVE Record.
- CWE-288Authentication Bypass Using an Alternate Path or ChannelA second route (a debug port, an API) reaches the protected function without the login check.
- CWE-78Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')Input reaches an operating-system shell, letting an attacker run any command the service can.