Barracuda Email Security Gateway: Critical Root Access Vulnerabilities (CVE-2026-116606, CVE-2026-111560)

Two critical vulnerabilities, CVE-2026-116606 and CVE-2026-111560, have been identified in Barracuda's Email Security Gateway (ESG) appliance. These flaws can be chained together to grant an unauthenticated attacker root-level access without needing any login credentials. If you operate a Barracuda ESG, you are directly affected and must apply the specified patches today to mitigate severe risk. Other Barracuda products are also affected by the command injection flaw, but require an administrator account for exploitation.

What Happened: A Chain to Root Access Without Login

Security researchers have revealed a critical attack chain impacting Barracuda Email Security Gateway (ESG) appliances. This chain exploits two distinct vulnerabilities: CVE-2026-116606, an authorization bypass, and CVE-2026-111560, an OS command injection. When these are combined, an attacker can execute commands with the highest level of system privileges-root-without any prior authentication.

The first vulnerability, CVE-2026-116606, is an authorization bypass specific to the Email Security Gateway. It allows an unauthenticated attacker to restore a specially crafted configuration backup. This malicious backup can then alter the appliance's global settings, setting the stage for the second part of the attack. Mandiant rated this bypass with a critical CVSS score of 9.3 out of 10.

The second vulnerability, CVE-2026-111560, is a command injection flaw found in common Barracuda code, affecting multiple products, including the ESG. This flaw permits an authenticated administrator to inject OS commands through the timezone configuration field, which then execute with root privileges. However, on the ESG, the authorization bypass (CVE-2026-116606) effectively grants an unauthenticated attacker the necessary administrative access to leverage this command injection. Mandiant assigned this vulnerability a high CVSS score of 8.6 out of 10.

Barracuda released patches for these issues on a Monday, with security firm watchTowr detailing the attack chain on a subsequent Thursday. The flaws were published as CVE records on 2026-11-02. It's important to note that these new vulnerabilities are distinct from CVE-2023-2868, which was a separate remote code injection flaw exploited in 2023 by the group UNC4841. As of 2026-11-03, neither CVE-2026-116606 nor CVE-2026-111560 appear in CISA's Known Exploited Vulnerabilities (KEV) catalog, and no public reports link them to active attacks.

Are You Affected? How to Check

Your organization is affected if you are running specific versions of Barracuda products. The most critical impact is on the Barracuda Email Security Gateway (ESG), where the two flaws can be chained for unauthenticated root access. Other Barracuda products are also affected by the command injection, but in those cases, it requires an existing administrator account.

For Barracuda Email Security Gateway users, any appliance running a firmware version earlier than 9.4.0.030 is vulnerable to the authorization bypass (CVE-2026-116606). Specifically for the command injection (CVE-2026-111560), ESG versions 0 up to 9.4.0.27 are affected. You should check your appliance's firmware version immediately.

If you use other Barracuda products listed below, verify your versions against the specified ranges for CVE-2026-111560. While this command injection still requires an authenticated administrator account on these products, it is a significant vulnerability that demands attention. Ensure you are running the latest patched firmware for all your Barracuda appliances.

The affected Barracuda products and their vulnerable versions are:

Immediate Actions to Take

Your priority must be patching. For Barracuda Email Security Gateway users, the fix for both CVE-2026-116606 and CVE-2026-111560 is integrated into version 9.4.0.030 and later. You must upgrade your ESG appliance to this version or a newer one immediately.

For all other Barracuda products affected by CVE-2026-111560, apply the specific patch released for each product. Barracuda's security advisory lists the fixed firmware versions. If you have turned off automatic patching, switch it back on to ensure you receive critical updates promptly. Proactive patch management is non-negotiable for critical internet-facing appliances like these.

If, for any reason, you cannot apply the patch at once, a crucial temporary mitigation is to limit access to the appliance's administration interface. Restrict this interface to trusted internal networks only. This action reduces the attack surface by making it harder for external, unauthenticated attackers to reach the vulnerable functions. This is a stop-gap measure and should not replace prompt patching.

Given the severity, if you are unsure about your organization's exposure or the patching process, engaging professional incident response services is a prudent step to ensure proper remediation and minimize risk.

How to Detect Exploitation

As of 2026-11-03, neither CVE-2026-116606 nor CVE-2026-111560 have been publicly tied to active attacks or added to CISA's Known Exploited Vulnerabilities catalog. While watchTowr, the firm that detailed the chain, released a detection tool, they have not published an exploit. This situation buys us some time, but it's not a guarantee against future exploitation.

To detect potential exploitation, focus on unusual activity on your Barracuda appliances. Monitor system logs for unexpected configuration changes, unauthorized file modifications, or any signs of shell commands being executed with root privileges, particularly those related to timezone settings or backup restoration. Look for unusual outbound network connections from the appliance that might indicate data exfiltration or command-and-control communication.

Maintaining robust logging and an active monitoring strategy is key. If you lack the internal resources for 24/7 monitoring, consider leveraging a 24x7 SOC service to detect and respond to threats effectively. Regular security audits and Vulnerability Assessment and Penetration Testing (VAPT) can also help uncover potential weaknesses before attackers do.

Impact on Small and Mid-size Businesses

For small and mid-size businesses, the Barracuda Email Security Gateway is a critical component of their cybersecurity posture, serving as a frontline defense against email-borne threats. An unauthenticated root access vulnerability like this one is catastrophic. If compromised, an attacker gains complete control over the appliance.

This level of access means an attacker could disable email filtering, use the ESG as a pivot point to compromise internal networks, steal sensitive data, or deploy ransomware. The fact that no authentication is required for the ESG makes this threat especially potent, as it significantly lowers the barrier for entry for malicious actors. It's an easy target for automated scanning and exploitation.

The previous CVE-2023-2868 incident, which involved a different flaw in the ESG exploited as a zero-day by UNC4841, underscores the value attackers place on these appliances. While not related to these new CVEs, it highlights a pattern of targeting email security devices due to their critical position in network infrastructure.

For SMBs, the cost of an incident can be devastating. Proactive cybersecurity measures, such as prompt patching, limiting administrative interfaces, and investing in comprehensive cybersecurity services, are not optional. They are essential for business continuity and resilience against sophisticated threats.

Sources