Barracuda has clarified that attackers do not need valid login credentials to exploit CVE-2026-116606, a pre-authentication authorization-bypass flaw in its Email Security Gateway (ESG).
The company updated its security advisory on November 5, changing the authentication requirement from “Yes, administrative access” to “No (Administrative UI Access Required).” The appliance’s administrative interface must still be reachable by the attacker.
According to Mandiant’s disclosure, CVE-2026-116606 affects ESG versions earlier than 9.4.0.030. It allows an unauthenticated remote attacker to invoke a configuration-import function and restore a crafted backup archive, making unauthorized changes to the appliance’s global configuration. The vulnerability has a CVSS 4.0 score of 9.3.
The flaw can be chained with CVE-2026-111560, a command-injection vulnerability affecting six Barracuda product lines. When an authenticated administrator processes a crafted timezone value, the second flaw can allow operating-system commands to run as root. Barracuda says the two issues together could let an attacker bypass authorization controls and obtain root access on an ESG appliance. CVE-2026-111560 carries a CVSS 4.0 score of 8.6.
Barracuda lists patches BNSF-40425 and BNSF-40430 for the Email Security Gateway, BNADC-16586 for the Load Balancer ADC and Web Application Firewall, BNMA-32468 for Message Archiver, BNWF-60060 for WAF Control Center, and BNYF-24789 for Web Security Gateway. The initial disclosure was covered in Abijita’s earlier report on the two vulnerabilities. The ESG product line was also targeted in a 2023 zero-day campaign involving CVE-2023-2868.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
