Barracuda ESG: two flaws chain to unauthenticated root

Short read

This post covers two Barracuda Email Security Gateway flaws that can be chained for root command execution with no login when the Admin UI is reachable to an attacker.

You'll learn what CVE-2026-116606 and CVE-2026-111560 each do, how the chain works at a high level, which other Barracuda products share the command-injection bug, and the practical steps Barracuda asks organisations to take this week.

Email security gateways sit on the critical path for almost every organisation: they inspect inbound mail, enforce policy, and often hold privileged configuration that reaches deep into the estate. When the management interface for that gateway is reachable from the wrong place, a pair of bugs can matter far more than either flaw alone.

This week, researchers showed that two vulnerabilities in Barracuda Email Security Gateway (ESG) can be chained so an unauthenticated attacker who can reach the Admin UI ends up with root command execution. There is no public report of in-the-wild exploitation for these two CVEs as of this week, and neither appears in CISA's Known Exploited Vulnerabilities catalogue yet — but the impact path is clear enough that patching and Admin UI exposure deserve attention now.

What the flaws are

Two CVEs sit behind the chain, and they play different roles.

CVE-2026-116606 is a pre-authentication authorisation bypass with a CVSS score of 9.3. An unauthenticated attacker with access to the Admin UI can restore a crafted configuration backup and change global settings. According to Barracuda's advisory, this bypass affects ESG only.

CVE-2026-111560 is an OS command injection via timezone configuration, scored CVSS 8.6. The injected command runs as root. On its own it normally needs an administrator. On ESG, the authorisation bypass can supply that access. The same command-injection issue also affects other Barracuda products — Load Balancer ADC, Message Archiver, WAF Control Center, WAF and Web Security Gateway — but on those products administrator authentication is still required.

Mandiant assigned the CVEs. SecurityWeek reports that Barracuda disclosed the command injection on 15 October and the authentication bypass on 22 October. Barracuda updated its advisory on 5 November 2026 to clarify that for CVE-2026-116606 authentication is not required, though Admin UI access is.

How the chain works

watchTowr and The Hacker News describe the same high-level sequence. None of what follows is a how-to; it is enough to understand why the combination matters.

A failed password-change path returns a low-privilege role instead of stopping the request. That leaves backup-restore reachable without a successful login. A restored backup can include a timezone value that is later executed as a shell command with root privileges. Barracuda protects configuration backups with a checksum, but the secret used for that check is built into the product code, so a checksum can be forged.

watchTowr demonstrated writing a file as root and released a detection tool. It has not published an exploit.

Who is affected — and why Admin UI exposure matters

For the full unauthenticated root chain, the product that matters is Email Security Gateway, and the practical condition is Admin UI reachability. Barracuda's guidance is explicit: exploitation requires the Admin UI to be reachable to the attacker. An organisation that keeps the Admin UI off the public internet is less exposed to this chain than one that leaves management open beyond trusted networks.

Other Barracuda appliances that share CVE-2026-111560 still need an authenticated administrator for that flaw. They are not in the same unauthenticated root path as ESG, but they still need the matching patches inventorying this week.

Historical context is worth separating carefully. ESG was hit in 2023 by the UNC4841 campaign via CVE-2023-2868, a different zero-day; Barracuda told customers then to replace compromised devices. That incident is a reminder of how costly ESG compromise can be. It is not the same pair of bugs disclosed this week.

What to do this week

Follow Barracuda's published guidance first, then widen the check to related products.

1. Apply the latest firmware / Barracuda's published patches. For ESG, Barracuda lists BNSF-40425 (9.4.017 and later) and BNSF-40430 (releases before 9.4.017). Mandiant and The Hacker News also describe ESG as fixed in 9.4.0.030 and later. Use Barracuda's Trust Center advisory as the source of truth for the build you run, and move to a patched release.
2. If you cannot patch at once, limit Admin UI access to trusted internal networks. That reduces the chance an unauthenticated attacker can reach the bypass at all.
3. Re-enable automatic patching if it has been turned off. Barracuda includes this in its remedial steps for a reason: appliances that stop taking vendor updates accumulate exactly this class of risk.

Also inventory other Barracuda products for CVE-2026-111560 and apply their product-specific fixes: BNADC-16586 (Load Balancer ADC / WAF), BNMA-32468 (Message Archiver), BNWF-60060 (WAF Control Center) and BNYF-24789 (Web Security Gateway). Confirm whether any Admin UI for ESG — or management interfaces for the related products — is reachable from networks it should not be.

The wider lesson for security appliances

Security appliances are trusted because they sit in the path of sensitive traffic and hold privileged configuration. That trust collapses quickly when their management planes are reachable from the internet and a bypass removes the login step.

Internet-facing admin UIs on email gateways, VPNs, WAFs and similar boxes keep recurring as the condition that turns a high-severity bug into an unauthenticated incident. Keeping management off the public internet, patching on the vendor's published IDs, and watching for unusual behaviour around the gateway — not only alerts from the appliance itself — are the boring controls that still decide outcomes.

The 2023 ESG campaign showed how painful a compromised email gateway can become. Today's CVEs are different bugs with a different disclosure path, and there is no public claim yet that they are being exploited in the wild. Treat that as time to patch and lock down Admin UI exposure, not as a reason to wait.

Sources: Barracuda Trust Center advisory, The Hacker News, SecurityWeek, watchTowr Labs, CCB Belgium advisory.