Barracuda Networks has patched two vulnerabilities in its Email Security Gateway (ESG) appliances that can be chained for full root access — with no credentials required at the entry point. Security Affairs reported the release of the fixes and warned that the combination raises the priority of unpatched, internet-facing appliances above what either bug's individual score suggests.
The first flaw, CVE-2026-116606, carries a CVSS score of 9.3 and is an authentication bypass. It allows an unauthenticated remote attacker to modify configuration settings on the appliance — no username, no password, no prior foothold. The second, CVE-2026-111560, supplies the escalation path that terminates at root. Used together, they move an attacker from the public network straight to full control of the mail filter. Administrators should confirm CVE assignment, affected firmware ranges and fixed versions directly against Barracuda's own advisory rather than any secondary summary.
For security teams, the chain changes how the pair should be assessed. Assessed separately, a 9.3 authentication bypass and a privilege-escalation bug can each look manageable against a remediation backlog. Chained together, the credential requirement disappears and the end state is superuser. Patch prioritisation that reads only standalone CVSS scores will under-prioritise this pair.
Administrators auditing for signs of intrusion should not treat the absence of authentication alerts as evidence that the appliance was untouched — an attacker who never presents credentials may not leave the trail that standard log rules expect. Any unit left unpatched across the exposure window should be treated as a potential compromise candidate rather than a routine upgrade: confirm the installed firmware, apply the vendor patch, then review configuration for changes made before the update. Where patching must be delayed, restricting management interfaces to trusted networks, monitoring configuration drift and watching vendor channels for exploitation indicators are stopgaps, not substitutes.
Guidance for Hong Kong deployments
Editorial guidance from the HKLUG team:
- Which units actually need the fix? Verify firmware against Barracuda's advisory. Cloud-hosted services and on-premises appliances sit in different scopes — confirm which applies before assuming coverage.
- Who owns the appliance? Many deployments sit with managed service providers. If an MSP operates the gateway, confirm in writing that the firmware update is scheduled and that configuration drift will be reported back to your team.
- Is the management plane exposed? Lock administrative access to a trusted network or VPN until the patch is applied, and treat that as a temporary control.
Background from public record
Barracuda has a documented history with the ESG line: in 2023 the company told customers that certain flaws — tracked as CVE-2023-2868 — could not be patched and advised replacing affected appliances outright.
That history sharpens the immediate task rather than replacing it. This update cycle is non-negotiable, and how long such appliances remain in the estate deserves a deliberate answer rather than an automatic renewal.
Barracuda's advisory contains the authoritative version ranges and mitigation guidance.
Source: Security Affairs
Barracuda Networks 已為其 Email Security Gateway（ESG）設備的兩個漏洞發布修補，兩者串連可取得完整 root 權限，入口毋須任何認證憑據。Security Affairs 報道了修補程式的發布，並警告稱這種組合令未修補且面向互聯網的設備，處理優先次序高於單一漏洞評分所顯示的水平。
第一個漏洞 CVE-2026-116606 的 CVSS 評分為 9.3，屬認證繞過（authentication bypass），允許未經認證的遠端攻擊者修改設備配置設定——毋須用戶名稱、毋須密碼、毋須事先立足點。第二個漏洞 CVE-2026-111560 提供最終通往 root 的權限提升路徑。兩者結合使用，可令攻擊者從公共網絡直接取得對郵件過濾器的完全控制權。管理員應直接對照 Barracuda 官方通告（advisory），核實 CVE 編號指派、受影響韌體範圍及已修復版本，而非依賴任何二手摘要。
對安全團隊而言，漏洞串連改變了這對漏洞的評估方式。分開評估時，一個 9.3 分的認證繞過漏洞與一個權限提升漏洞，面對補救待辦清單似乎各自尚可應付；一旦串連，認證要求便消失，最終結果是超級用戶。只按單獨 CVSS 評分排序的修補優先次序，會低估此漏洞組合的嚴重性。
管理員在審計入侵跡象時，不應把「沒有認證警報」視為設備未被觸碰的證據——從不提交憑據的攻擊者，未必會留下標準日誌規則所預期的痕跡。在漏洞暴露期間一直未修補的任何設備，應視為潛在受入侵對象，而非例行升級處理：確認已安裝的韌體、套用廠商修補程式，然後檢查配置是否在更新前曾被改動。如必須延遲修補，則可將管理介面限制於可信網絡、監控配置漂移（configuration drift），以及密切留意廠商渠道的漏洞利用指標——這些是權宜之策，並非替代方案。
香港部署指引
HKLUG 團隊編輯建議：
- 哪些設備確實需要修復？ 對照 Barracuda 官方通告核實韌體版本。雲端託管服務與內部部署（on-premises）設備屬不同範圍——須先確認適用範圍，再假設已獲覆蓋。
- 設備由誰擁有？ 不少部署由管理服務供應商（MSP）負責。若閘道由 MSP 營運，應以書面形式確認韌體更新已排定日程，且配置漂移會回報予貴方團隊。
- 管理層面（management plane）是否對外暴露？ 在套用修補程式之前，將管理員存取鎖定至可信網絡或 VPN，並視之為臨時控制措施。
背景：取自公開紀錄
Barracuda 的 ESG 產品線有紀錄在案的歷史：2023 年，公司曾告知客戶平台上的部分漏洞——編號 CVE-2023-2868——無法透過修補解決，並建議直接更換受影響設備。
這段歷史令眼前的任務更為緊迫，而非取而代之。今次更新周期不容妥協，而此類設備在資產組合中應保留多久，值得深思熟慮地作出決定，而非自動續用。
Barracuda 官方通告載有權威的版本範圍及緩解指引。