On 6 November 2026 analysis detailed that two Barracuda Email Security Gateway flaws—CVE-2026-116606 (authorization bypass, CVSS 9.3) and CVE-2026-111560 (command injection, CVSS 8.6)—can be chained for unauthenticated root command execution. Barracuda released fixes; ESG is fixed in 9.4.0.030 and later. Neither flaw is in CISA KEV yet and no active exploitation is reported. Immediate patching or restricting the admin interface to trusted networks is advised.

What it means: For Greek organisations running Barracuda ESG on the email edge, apply 9.4.0.030+ immediately, re-enable automatic patching if disabled, and limit admin access to VPN/internal networks. Review logs for suspicious backup restores before the patch. Command injection also hits other Barracuda products with admin required; prioritise ESG because of unauthenticated root. Notify SOC/MDR providers. In practice, teams should name an owner, update the risk register and agree success criteria within 30 days. Where suppliers or customers are affected, send a short note citing the primary source without overclaiming. Compliance, security and operations are linked; one change often needs contract, access-rights and continuity checks. Keep a review calendar so the news becomes concrete actions for the Greek business. In practice, teams should name an owner, update the risk register and agree success criteria within 30 days. Where suppliers or customers are affected, send a short note citing the primary source without overclaiming. Compliance, security and operations are linked; one change often needs contract, access-rights and continuity checks. Keep a review calendar so the news becomes concrete actions for the Greek business.

Read the original on The Hacker News / Barracuda

Related service: Custom software

Related stories