Barracuda Email Security Gateway flaws chained to unauthenticated root access

Overview

Updated 1 hour ago

On November 6, 2026, the security research group watchTowr Labs published a working exploit chain that takes an unauthenticated attacker to root on Barracuda Email Security Gateway. The chain combines CVE-2026-116606, a pre-authentication authorization bypass rated 9.3, with CVE-2026-111560, an OS command injection rated 8.6 that also affects five other Barracuda product lines.

The bypass lives in the appliance's password-change handler: when a change fails, the code returns the low-privilege login role instead of stopping the request. That lets an unauthenticated request reach a backup-restore function, where a crafted system_timezone value is passed to a shell command that runs as root. Barracuda's advisory says exploitation requires the administrative interface to be reachable by the attacker.

Why it matters

Any Barracuda appliance with its admin interface exposed to the internet can be rooted without a password until the firmware is updated.

Questions about this story

Free account needed to ask — your question is kept and asked for you right after sign-up. Answers are public.

No questions yet — be the first to ask.

Key Indicators

9.3

CVSS score, CVE-2026-116606

Barracuda rates the pre-authentication authorization bypass as critical.

8.6

CVSS score, CVE-2026-111560

The command injection is rated high and affects six product lines.

Product lines affected by the command injection

ESG, Load Balancer ADC, Message Archiver, WAF Control Center, WAF and Web Security Gateway.

Confirmed in-the-wild exploitations reported

Neither Mandiant nor Barracuda reported active exploitation as of the advisories.

Voices

Curated perspectives — historical figures and your fellow readers.

Organizations Involved

Barracuda Networks

Security appliance vendor

Vendor issuing patches and advisories for both flaws

Campbell, California-based maker of email, network and application security appliances.

watchTowr Labs

Security research group

Published the working exploit chain

Research arm of the attack-surface management firm watchTowr, known for diffing vendor patches.

Mandiant

Incident response and threat intelligence firm

Published advisories for both vulnerabilities

Google-owned security firm that coordinated disclosure with Barracuda.

Timeline

October 2026 November 2026

5 events Latest: Today

Tap a bar to jump to that date

November 2026
watchTowr publishes the exploit chain
Today Research

watchTowr Labs shows how the two flaws combine to execute commands as root without login.
Today
Barracuda changes the authentication requirement
Advisory update

The advisory flips CVE-2026-116606 from requiring admin access to not requiring authentication, only admin UI reachability.
Yesterday • 14:30 EST
Canada issues advisory AV26-1112
Government advisory

The Canadian Centre for Cyber Security lists affected Barracuda products and versions.
4 days ago
October 2026
Barracuda reports the authorization bypass
Disclosure

Barracuda notifies Mandiant of the pre-authentication bypass tracked as CVE-2026-116606.
October 22nd, 2026
Barracuda reports the command injection
Disclosure

Barracuda notifies Mandiant of the OS command injection later tracked as CVE-2026-111560.
October 15th, 2026

Scenarios

Attackers exploit the chain against exposed Barracuda appliances

Possible Resolves by Feb 6, 2027

Discussed by: watchTowr Labs and Mandiant, both of which stress that the admin interface must be reachable

With a public write-up and a working path, attackers scan for Barracuda ESG admin interfaces and attempt the backup-restore route. Success depends on whether the target is unpatched and whether the admin UI is internet-facing. Barracuda's own guidance says restricting the interface to trusted networks removes the exposure.

Patches hold and no confirmed exploitation surfaces

Likely Resolves by May 6, 2027

Discussed by: Barracuda and Mandiant advisories, which reported no known exploitation at publication

Most customers apply the firmware patches, network teams restrict admin access, and the public proof-of-concept produces scanning noise but no confirmed intrusions. This is the outcome the vendor advisories currently describe.

The command injection is exploited on its own by an authenticated insider

Possible Resolves by May 6, 2027

Discussed by: Mandiant's advisory, which describes the command injection as reachable by an administrator

Even without the bypass, CVE-2026-111560 lets someone with admin access run OS commands as root through the timezone setting. That makes the flaw useful in intrusions that already have credentials, and it affects five products beyond ESG.

Historical Context

3 moments from history that rhyme with this story — and how they unfolded.

May 2023

Barracuda ESG zero-day (2023)

Barracuda disclosed CVE-2023-2868, a command injection in its Email Security Gateway that had been exploited since October 2022 by a group tracked as UNC4841. The company told customers to replace affected appliances rather than simply patch them.

Then

Barracuda shipped replacement hardware and took affected devices out of service.

Now

The incident established that edge email gateways are high-value targets and that patching alone may not be enough after a compromise.

Why this matters now

The same product line is at the center of this chain, and the 2023 response shows how Barracuda has handled root-level bugs in the past.

May-June 2023

MOVEit Transfer exploitation (2023)

The CL0P group exploited CVE-2023-34362, a SQL injection in Progress Software's MOVEit Transfer file-sharing appliance, to steal data from thousands of organizations. The flaw was reachable without authentication.

Then

Progress rushed patches while CL0P extorted victims across government, finance and healthcare.

Now

The campaign became the reference case for mass exploitation of an internet-facing file transfer appliance.

Why this matters now

It shows what happens when a pre-authentication flaw in an edge appliance gets a public exploit: scanning and mass attempts follow quickly.

March 2021

Microsoft Exchange ProxyLogon (2021)

Four zero-days in on-premises Exchange Server, including a pre-authentication remote code execution flaw, were exploited by a group tracked as Hafnium before patches were broadly applied.

Then

Microsoft shipped emergency patches and the FBI removed web shells from affected servers.

Now

ProxyLogon pushed many organizations to accelerate patching of internet-facing infrastructure.

Why this matters now

It is the clearest precedent for a pre-authentication bug in widely deployed server software turning into a race between patching and exploitation.