Barracuda CVE-2026-116606 Pre-Auth Bypass Chains with CVE-2026-111560 for Root on ESG Admin Interface

Barracuda disclosed the pair on its ESG and supporting products including Load Balancer, WAF, and Web Security Gateway. The first flaw permits pre-auth bypass of authorization controls; the second allows command execution. Chaining yields root without valid credentials once interface reachability is achieved. Affected firmware versions remain unspecified in the initial notice.

Procurement records and prior incident reports show Barracuda appliances frequently retain public admin exposure despite repeated advisories. The 2023 ESG zero-day campaign (CVE-2023-2868) demonstrated the same pattern: attackers scanned for and compromised internet-facing instances before patches propagated. Contract data from federal and enterprise buyers indicate minimal network segmentation requirements in many deployments.

Official statements emphasize interface restriction and firmware updates yet omit independent confirmation of exploit chains or telemetry on active scanning. NVD entries and Shodan historical data reveal thousands of ESG instances still indexed publicly months after similar disclosures, indicating enforcement gaps rather than isolated misconfigurations.

Next steps include monitoring for post-patch firmware telemetry and cross-referencing with CISA KEV listings. Organizations should audit admin ACLs against known Barracuda management ports within 30 days.