On November 2, 2026, Barracuda published patches for two vulnerabilities that can be chained on Email Security Gateway (ESG). This appliance helps protect business email. Teams and their providers should verify which patches are actually installed and who can reach its management interface.
Two steps with different prerequisites
CVE-2026-116606 allows unauthorized changes to ESG configuration through restoration of a crafted backup. Mandiant describes it as an authentication bypass requiring no credentials. CVE-2026-111560 is command injection requiring administrator privileges. Barracuda says combining the flaws can result in operating-system commands running as root.
Separate network reachability from authentication
SecurityWeek identifies inconsistent wording: Barracuda’s table lists administrative access for both issues while calling the first pre-authentication. Mandiant’s description clarifies that initial step. Reaching the interface over a network and possessing an administrator account are different requirements. A login screen alone is therefore insufficient reason to dismiss exposure.
Verify each product and patch
Only ESG is listed for both vulnerabilities. Command injection also affects ADC, Message Archiver, WAF Control Center, Web Application Firewall and Web Security Gateway. Barracuda provides product-specific patch identifiers and asks customers to install current firmware and all security patches. Older devices may require several upgrades; confirm the result with support or your maintenance provider.
Restrict exposure and review history
Barracuda recommends limiting administration to trusted internal networks. Field Effect explains the operational significance: an email security appliance occupies a sensitive position in the mail path. If management access was overly broad, review administrative logins, backup restorations and configuration changes. These are investigation leads, not evidence that your organization’s messages were intercepted.
How Soclyde relates
ESG maintenance involves privileged credentials potentially used by several people. Soclyde helps locate these records in an encrypted local vault and share access in Premium without multiplying email copies. Network restrictions and appliance patches still need to be applied within the Barracuda infrastructure.
What to remember
Check your Barracuda inventory, required patches and authorized management networks. The consulted analyses do not establish observed exploitation of these two flaws; incidents from 2023 should not be presented as current evidence. To organize maintenance access, contact Soclyde.
