CVE-2026-116606: Barracuda ESG Bug Chain Gives Root Access

Two chained vulnerabilities in Barracuda's Email Security Gateway allow an unauthenticated attacker to fully compromise the appliance, ultimately gaining root-level command execution. The attack exploits an authorization bypass flaw triggered by a failed password change, then leverages a forged backup file with a malicious timezone string to inject OS commands. This matters because email security gateways sit at the perimeter of an organization's defenses — rooting one hands attackers access to email traffic, credentials, and potentially the broader internal network. The exploit requires no authentication, dramatically lowering the bar for attackers and meaning any internet-exposed ESG is at risk until patched.