TL;DR

what: watchTowr showed that an authorization bypass (CVE-2026-116606) and a command injection (CVE-2026-111560) in Barracuda's Email Security Gateway can be chained to run commands as root.

impact: An attacker who has never logged in can take full root control of an email filtering appliance that sits on the network perimeter and processes corporate mail.

fix: Barracuda has released patches for every affected product, the Email Security Gateway is fixed in firmware 9.4.0.030 and later, and the interim mitigation is to limit the admin interface to trusted internal networks.

who: Any organization running the Barracuda Email Security Gateway, plus five other Barracuda products where the command injection still needs an administrator account.

Two vulnerabilities in Barracuda's Email Security Gateway (ESG) can be chained so that an attacker runs commands as root on the appliance without any credentials.…