CRITICAL: Barracuda ESG Bug Chain Hands Attackers Root Without a Login

If you were hoping the Barracuda Email Security Gateway had used up its lifetime supply of bad weeks back in 2023, I have some unfortunate news. Barracuda shipped patches on Monday for two vulnerabilities that, chained together, let an attacker who has never logged in run commands as root on the appliance. On Thursday, the researchers at watchTowr published a technical breakdown of exactly how that chain works, which means the clock most of us were quietly counting on just got a lot shorter.

The two bugs are tracked as CVE-2026-116606 and CVE-2026-111560. Mandiant, acting as the CVE numbering authority, assigned both records and scored them at 9.3 and 8.6 respectively. Barracuda's own advisory labels both as "High," which is a perfectly defensible reading of each bug in isolation and a very misleading reading of what they do together. An unauthenticated path to root on an internet facing email filter is a critical problem in any language, and that is how you should treat it. Drop everything and patch this now.

As of this writing, neither CVE appears in CISA's Known Exploited Vulnerabilities catalog, and nobody has publicly tied either flaw to an attack. watchTowr released a detection tool that checks whether an appliance is vulnerable, but it has not published a working exploit. That is the good news. The bad news is that the write up describes the mechanics in enough detail that a motivated attacker does not need much more help.

How the chain works

CVE-2026-116606 is the door. It is an authorization bypass that affects only the Email Security Gateway, and it lets an unauthenticated attacker restore a crafted configuration backup and change the appliance's global settings. According to watchTowr, the root cause is almost comically small. When a password change request fails, the appliance does not stop processing the request. Instead, it hands the requester a low privilege role and carries on. That role is enough to reach the backup restore function, which really should sit behind a full administrator login and very much does not.

CVE-2026-111560 is the payload. It is a command injection flaw that, on its own, requires an administrator account to reach. On the Email Security Gateway, the bypass above provides that access for free. The injection point is a timezone value stored inside the restored configuration data, which the appliance later passes to a shell command running with root privileges. So the attacker uploads a backup, the backup carries a poisoned timezone, and the appliance obligingly executes whatever was tucked inside it as root.

You might reasonably ask whether Barracuda protects those backups against tampering. It does, in the sense that each backup carries a checksum. The problem is that the secret used to compute that checksum is hardcoded in the product's code. Anyone who pulls apart the firmware can compute a valid checksum for a forged backup, and watchTowr did exactly that. Their proof of concept wrote a file to the appliance as root, which is the polite research way of saying "we own the box." A hardcoded secret protecting an integrity check is the security equivalent of a padlock with the combination engraved on the side, and it is the kind of design shortcut that keeps showing up in network appliances year after year.

There is one wrinkle worth flagging. Barracuda's original advisory text stated that successful exploitation requires access to the administrative interface of an affected product. An update on November 6 clarified that attackers do not need admin privileges. Both statements can be true at the same time. You need network reach to the administrative interface, but you do not need valid credentials for it. That distinction matters a great deal when deciding how exposed you really are, and it is why the single most useful mitigation after patching is making sure that interface is not reachable from the internet at all.

Who is affected

The full root chain applies only to the Email Security Gateway, because CVE-2026-116606 exists only there. The Canadian Centre for Cyber Security, in advisory AV26-1112, lists ESG builds prior to 9.4.0.030 as affected. Barracuda distributed the fix as patch BNSF-40425 for appliances running 9.4.017 and later, and as BNSF-40430 for anything older than 9.4.017.

CVE-2026-111560 reaches further. The same command injection bug sits in five other Barracuda products, although on those it still requires an authenticated administrator. The Load Balancer ADC is affected prior to 6.4.0, the Web Application Firewall prior to 11.0.1, the Web Security Gateway prior to 16.1.100.100, the Message Archiver prior to 5.5.4.0, and the WAF Control Center prior to 2.2.1. Barracuda's patch identifiers for those products are BNADC-16586 for both the Load Balancer ADC and the WAF, BNMA-32468 for the Message Archiver, BNWF-60060 for the WAF Control Center, and BNYF-24789 for the Web Security Gateway. A post authentication root bug is less urgent than a pre authentication one, but it turns any stolen or reused admin password into full control of the device, so do not let those products slide to the bottom of the pile.

Why this one deserves your attention

Anyone who worked incident response in mid 2023 remembers what happened the last time the ESG had a serious bug. A China nexus group that Mandiant tracks as UNC4841 exploited CVE-2023-2868 as a zero day for months before anyone noticed, planted persistent backdoors, and burrowed in deeply enough that Barracuda eventually told affected customers to physically replace their appliances rather than trust a patch. The same group came back later that year through CVE-2023-7102. To be clear, nothing ties this week's pair of flaws to UNC4841 or to any other actor. But the ESG has already proven itself to be a target that well resourced attackers care about, and those attackers read watchTowr's blog just like the rest of us.

Email gateways are also an uncomfortable place to lose control. They sit on the perimeter by design, they see every inbound and outbound message, and they often hold credentials and trust relationships into the mail platform behind them. An attacker with root on the filter can quietly read mail, tamper with delivery rules, or use the box as a beachhead into the internal network, and most organizations have far less visibility into appliance internals than they do into their Windows endpoints. Root on an email gateway is not a nuisance. It is a front row seat to the entire business.

There is also the familiar timing problem. The window between a vendor patch and public exploitation has been shrinking for years, and a detailed technical write up tends to shrink it further. When a research team explains the bypass, the injection point, and the checksum weakness in one post, reproducing the chain becomes an afternoon project rather than a research effort. If your plan was to get to this during next month's maintenance window, that plan needs to change.

What to do right now

Start by confirming the firmware version on every Barracuda Email Security Gateway you are responsible for. Anything below 9.4.0.030 needs BNSF-40425 or BNSF-40430 applied, depending on which side of 9.4.017 it sits. Barracuda's advisory also urges customers who have switched off automatic security patching to turn it back on, and this is a good moment to find out how many of your appliances quietly had it disabled during some troubleshooting session years ago.

If you cannot patch immediately, restrict the administrative interface so that it is reachable only from trusted internal networks or a dedicated management segment. That is good hygiene for every appliance you own, and here it directly cuts off the precondition the chain depends on. While you are at it, run watchTowr's detection tool against your appliances so you have evidence of their state before and after the patch.

Patching closes the hole, but it does not tell you whether someone walked through it before you got there. Review the appliance's configuration for changes you did not make, paying particular attention to the timezone setting and to any backup restore activity in the logs that does not line up with a change ticket. Look for failed password change attempts followed by configuration activity from the same source, since that pattern is the fingerprint of the bypass. Check firewall and proxy logs for unusual outbound connections originating from the gateway itself, because an email filter that suddenly starts calling out to unfamiliar hosts is telling you something. If anything looks off, treat the appliance as compromised and lean on Barracuda support, since the 2023 campaign proved that persistence on these devices can survive a simple firmware update.

For the other five products, schedule the patches promptly and use the occasion to audit who holds administrator accounts on them. Remove stale accounts, rotate shared passwords, and make sure multifactor authentication is enforced wherever the product supports it. A post authentication bug is only as hard to reach as your weakest admin password.

Finally, if you rely on a vulnerability scanner, confirm it has the new checks loaded and is actually reaching these appliances. Network devices are notorious for falling outside scanner coverage, and it is far better to discover that gap today than during an incident review.

The MSP angle

Every client running a Barracuda ESG just handed you a reason to call them today, and the conversation does not end at the patch. Offer an appliance exposure review that checks firmware, automatic patching status, and whether management interfaces are reachable from the internet across all of their edge devices, then package continuous perimeter monitoring and attack surface management as the recurring service that keeps the next one of these from becoming an emergency.