A Barracuda ESG vulnerability pair, CVE-2026-116606 and CVE-2026-111560, lets an attacker with no account run commands as root on Barracuda's Email Security Gateway. The fix is firmware 9.4.0.030 or later. Patching matters because this appliance sees every email your business handles, including the password resets that control your website.
