Barracuda ESG authorization bypass CVE-2026-116606 chains with command injection CVE-2026-111560 for unauthenticated root

The chain begins when a failed password change returns a low-privilege role instead of rejecting the request, exposing the backup-restore endpoint. watchTowr traced that the endpoint accepts an uploaded archive whose timezone field is later executed as root; the HMAC secret used to validate the archive is hardcoded in firmware, allowing an attacker to craft a valid checksum and write arbitrary files. Mandiant assigned CVSS 9.3 and 8.6 respectively. Only the Email Security Gateway is affected by the bypass; five other Barracuda products remain vulnerable to the injection once an admin account is obtained. The 2023 UNC4841 campaign against the same appliance used an unrelated zero-day (CVE-2023-2868), revealing a recurring target surface rather than a new actor. Barracuda shipped fixes in ESG 9.4.0.030 and equivalent firmware for remaining products. No samples appear in public exploit repositories and CISA KEV lists neither identifier. The pattern of email-security appliances carrying persistent remote-execution flaws indicates procurement and patching cycles continue to lag behind disclosure velocity.