Search — “CVE-2026-111560”

Barracuda updated its advisory to confirm that two patched Email Security Gateway flaws are being exploited against a limited number of customers. Per BleepingComputer, CVE-2026-116606 is an authentication weakness allowing modification of global configuration, and CVE-2026-111560 allows unauthenticated OS command injection running as root; combined, they allow authorization bypass and root access, but require access to the Admin UI. Hunters should review Admin UI access logs and look for unexpected OS command execution from the appliance and unauthorized global configuration changes, and confirm patch status (BNSF-40425 for 9.4.017+, BNSF-40430 for earlier versions).

Two flaws in Barracuda's Email Security Gateway can be chained by an unauthenticated attacker to run commands as root, per watchTowr's technical write-up. The authorization bypass (CVE-2026-116606) lets an attacker restore a crafted backup, and the command injection (CVE-2026-111560) runs a restored timezone value as root; the backup checksum secret is hardcoded. Sources state no known exploitation, no KEV listing, and no public report tying either flaw to an attack; the fix is ESG 9.4.0.030 or later.

Barracuda released patches for CVE-2026-116606 (authentication bypass in ESG versions earlier than 9.4.0.030, allowing unauthenticated restore of a crafted configuration backup) and CVE-2026-111560 (administrator-authenticated command injection in the timezone setting, shared with five other Barracuda products). Combined, the flaws can yield root on ESG appliances, and neither advisory states whether they have been exploited in the wild. Defenders should confirm admin interfaces are restricted to trusted networks and that all firmware patches are applied.

Barracuda disclosed a pre-authentication authorization bypass (CVE-2026-116606, CVSS 9.3, Email Security Gateway only) and a command injection flaw (CVE-2026-111560, CVSS 8.6, across several products) that together could let an attacker bypass authorization and obtain root. Exploitation requires access to the administrative interface, so exposure depends on whether admin interfaces are reachable from the internet. The source reports no exploitation; hunters should focus on admin-interface access logs and firmware currency rather than specific attack artifacts.