Barracuda Releases Patches After Dual ESG Flaws Allow Full System Takeover

Barracuda Networks has issued security updates that close two critical vulnerabilities in its Email Security Gateway (ESG) appliances, flaws that can be linked together to grant an attacker complete root control of the device.

The first vulnerability, identified as CVE-2026-116606, carries a high CVSS rating and stems from improper input validation in the appliance's web management interface. A second, related flaw—also rated as high severity—enables privilege escalation once initial code execution is achieved. Security researchers demonstrated that exploiting both weaknesses in succession allows full system compromise.

Root access to an ESG appliance gives a malicious actor unrestricted ability to read, alter, or delete corporate email traffic, modify security policies, and potentially use the compromised server as a foothold for broader network infiltration. The impact is especially concerning for organizations that rely on ESG devices as the primary line of defense against phishing, malware, and data exfiltration.

ESG appliances are deployed worldwide by enterprises, service providers, and government agencies to filter inbound and outbound email, enforce encryption, and provide advanced threat protection. Their central role in handling sensitive communications makes any breach a high‑profile target for threat actors seeking to harvest confidential information or disrupt business operations.

In its advisory, Barracuda urged customers to apply the newly released firmware patches without delay. The company also provided temporary mitigation steps, such as restricting access to the management console and monitoring for anomalous login activity, for environments where immediate updating is not feasible.

The discovery highlights a growing trend of attackers chaining multiple vulnerabilities to achieve privileged access, underscoring the importance of rapid patch management and continuous security monitoring. Analysts recommend that organizations review their ESG deployment configurations, verify that the latest patches are installed, and consider additional network segmentation to limit the potential blast radius of any future compromise.