Barracuda ESG authentication bypass can combine with a root command-injection flaw

Barracuda says the two flaws can be combined to obtain root access when an attacker can reach the administrative interface. Only ESG is listed as affected by the authentication bypass. Do not extend that unauthenticated chain to every other product.

Mandiant identifies the command-injection exposure as ESG through 9.4.0.27, ADC through 6.4.0, WAF through 11.0.1, WSG through 16.1.100.100, BMA through 5.5.4.0 and WCC through 2.2.1. The timezone flaw by itself requires administrator authentication. The ESG import bypass has a separate affected range: before 9.4.0.030.

The vendor originally labelled both vulnerabilities as requiring administrator authentication, contradicting its pre-authentication description and Mandiant’s ESG finding. At 19:30 UTC on November 5 (14:30 EST), Barracuda explicitly corrected CVE-2026-116606 to require administrative-UI reachability, not authentication. This resolves the label conflict, rather than identifying another flaw or attack. The timezone issue still requires administrator access. Treat reachability of the management service as exposure; an existing administrator login is not a dependable protection against the ESG chain.

The patch identifiers above are copied from Barracuda, including BNADC-16586 for both ADC and WAF. The firmware range for one CVE does not establish a safe release for every product or replace patch verification. No confirmed attacks, victim count or public exploit are established by these disclosures. This is rated L3 because it affects mainstream perimeter and messaging appliances.