Barracuda ESG Authentication Bypass Flaw Opens Path to Root

* CVE-2026-116606 has a CVSS score of 9.3 and affects only the ESG.
* CVE-2026-111560 has a CVSS score of 8.6 and impacts five other Barracuda products.
* CVE-2026-116606 is an authentication bypass allowing an unauthenticated remote attacker to invoke a configuration-import function and restore a crafted backup archive, resulting in unauthorized modification of the ESG’s global configuration.
* CVE-2026-111560 is a command injection issue located in the timezone configuration setting, shared across several Barracuda products.
* Exploiting the command injection flaw, if combined with the authentication bypass, could allow an attacker to obtain root access to the device.
* The command injection flaw affects ESG, Load Balancer Application Delivery Controller (ADC), Message Archiver, WAF Control Center, Web Application Firewall (WAF), and Web Security Gateway (WSG).
* Barracuda advises that attackers must reach an appliance’s admin interface to exploit these flaws.
* Mandiant reports the command injection vulnerability on October 15 and the authentication bypass on October 22.
* Previous targeting of ESG appliances involved exploitation of CVE-2023-2868 by Chinese cyberspies starting in October 2022.

The narrative centers on the severity of chaining vulnerabilities—an authentication bypass and a command injection—to achieve the highest level of system compromise, root access. The juxtaposition of the two flaws, one exploitable without authentication (authentication bypass) and the other requiring administrative privileges (command injection), highlights a layered risk management failure where individual security postures are insufficient; the critical failure point is the ability to combine these flaws effectively. The pattern suggests that vendors release patches for multiple, related bugs simultaneously, often after previous attacks have already occurred against specific components. The distinction made between the two bugs—one being a pre-authentication issue and the other requiring credentials—shifts the required defensive posture: focusing on network access control (for the authentication bypass) versus strict privilege management (for the command injection). The implication for organizational defense is that merely patching individual CVEs is insufficient; the context demands understanding how these flaws interact in a multi-stage attack sequence. This introduces a pattern of escalation where lower-level errors serve as necessary precursors to achieving ultimate control, forcing defenders to assess access controls and configuration integrity not just at the application layer, but across the entire management plane.
Bridge Questions: What are the existing network segmentation policies that govern access to ESG administrative interfaces? How robust are the current identity and access management systems in preventing privilege escalation across these different product lines? What processes are in place to ensure that automated patching correctly accounts for manually applied fixes without introducing new configuration drift?