Barracuda patches ESG flaws that chain to root
An authentication bypass in Email Security Gateway and a command injection in shared appliance code can be combined for root access, Barracuda says.
Barracuda has released patches for two vulnerabilities in its Email Security Gateway (ESG) appliances that can be chained to get root on the box, SecurityWeek reported on 4 November 2026.
The first is an authentication bypass that affects only ESG. Mandiant's advisory says an unauthenticated remote attacker can reach a configuration-import function and restore a crafted, compatible backup archive, which changes the appliance's global configuration. The second is a command injection in the timezone configuration field, in code shared across several Barracuda products. An attacker already logged in as administrator could use it to run OS commands as root.
Barracuda's own line is that exploiting them together lets an attacker skip authorization controls and land root. The command injection also touches the Load Balancer ADC, Message Archiver, WAF Control Center, Web Application Firewall and Web Security Gateway.
There's a wrinkle in the paperwork. Barracuda's advisory marks administrative access as required for both bugs while also calling the bypass pre-authentication, and Mandiant says the ESG flaw needs no authentication at all. We'd go with Mandiant's reading and treat the ESG issue as reachable by anyone who can get to the admin interface.
That interface is the practical limit. Barracuda says attackers need to reach it, and advises keeping it on trusted internal networks only. Customers should move to the newest firmware and check that every patch is installed; anything not applied automatically has to be done by hand, and appliances with automatic patching switched off should have it turned back on.
Mandiant says Barracuda reported the command injection on 15 October and the bypass on 22 October. Neither advisory says whether either flaw has been exploited in the wild.
ESG has been a target before. Chinese cyberspies exploited a zero-day, CVE-2023-2868, starting in October 2022, and Barracuda ended up telling customers to replace compromised devices. That history is context, not evidence of a new campaign.
CVE references
Sources
- Barracuda ESG Authentication Bypass Flaw Opens Path to RootPrimarywww.securityweek.com
If something here is wrong, tell us. Every correction is listed on the corrections page.
Don’t Just Read About Cyberattacks. Learn How They Work.
Go beyond the headlines. Explore hands-on cybersecurity labs, understand real-world vulnerabilities, and build practical security skills with HackZoneLabs.
Start Learning