Two chained Barracuda ESG flaws deliver pre-authentication root access
On November 2, 2026, Barracuda patched CVE-2026-116606 and CVE-2026-111560, two flaws watchTowr chained to reach root on the Email Security Gateway with no login at all. Apply BNSF-40425 or BNSF-40430 now and pull the admin interface off the public internet.