Barracuda Email Security Gateway Flaw Chain Gives Attackers Root Without a Login

Two vulnerabilities in Barracuda's Email Security Gateway (ESG) can be chained so that an attacker runs commands as root on the appliance without any credentials. Barracuda released patches during the first week of November 2026, and watchTowr published a full technical breakdown of the chain a few days later. Mandiant assigned both CVE records. It rates the authorization bypass 9.3 out of 10 and the command injection 8.6.

The ESG sits in front of corporate mail. It handles inbound and outbound messages and attachments, and it is often wired into directory services. Root on that box gives an attacker a privileged foothold at the network edge, and this chain gets there without a login.

Two Flaws, One Unauthenticated Path

CVE-2026-116606 is an authorization bypass. An unauthenticated attacker can use it to restore a crafted configuration backup and change the appliance's global settings. It affects only the Email Security Gateway.

CVE-2026-111560 is a command injection that runs commands as root. On its own it requires an administrator account. On the ESG, the bypass supplies that access, so the requirement to log in no longer applies.

How the Chain Works

watchTowr traced the chain through the appliance's code. Four weaknesses line up:

• Failed password change fails open: instead of rejecting the request, the appliance gives the attacker a low-privilege role.
• Backup restore becomes reachable: that role is enough to reach a backup-restore function that should require authentication.
• Hardcoded checksum secret: Barracuda protects backups with a checksum, but the secret used to compute it is built into the code, so an attacker can compute a valid checksum for any crafted backup.
• Timezone field reaches a root shell: the restored configuration includes a timezone value that the appliance later runs as a shell command with root privileges.

watchTowr demonstrated the chain by writing a file to the appliance as root. Each piece is a common bug class on edge devices: an error path that hands out a usable session instead of ending the request, an integrity check whose key ships inside the product, and a configuration field passed to a shell. Chained together, they turn a backup feature into remote root.

Affected Products and Severity

The authorization bypass affects only the ESG. The command injection also affects five other Barracuda products, but on those it still requires an administrator account. That limits exposure to attackers who already hold valid or stolen admin credentials. Barracuda's security advisory lists the fixed firmware for each affected product. For the ESG, the fix is version 9.4.0.030 and later.

The severity scores reflect that difference. The 9.3 bypass is the critical piece because it removes authentication. The 8.6 injection is serious on any product, but only the ESG pairs it with a way in that needs no login.

Exploitation Status

As of this week, neither CVE appears in CISA's Known Exploited Vulnerabilities catalog, and no public report ties either flaw to an attack. watchTowr released a detection tool that checks whether an appliance is vulnerable. It has not published an exploit.

Barracuda's Fix and Mitigation

Barracuda's advisory sets out three steps. First, apply the patch for each affected product or upgrade to the fixed firmware it lists. Second, where patching cannot happen right away, restrict the appliance's administration interface to trusted internal networks. Third, turn automatic patching back on for any appliance where it was disabled.

Restricting the interface shrinks exposure to the unauthenticated chain, but it does not remove the flaws. An attacker who is already inside the network, or who reaches the interface through an overly broad firewall rule, still has a path. The advisory presents the restriction as a measure for organizations that cannot patch at once, not as a replacement for the patch.

Why This Appliance Draws Attention

The ESG has been targeted before. In 2023, a group tracked as UNC4841 exploited a different flaw, CVE-2023-2868, as a zero-day against the same product. That campaign is unrelated to the two flaws patched this month, and nothing ties the new pair to any attacker. The history matters because it shows attackers choose this kind of device: email gateways handle sensitive traffic, sit on the perimeter and run firmware that most security teams cannot inspect.

The automatic patching step in the advisory deserves attention. Some organizations turn off vendor auto-updates on perimeter appliances to control change windows. Now that an unauthenticated root chain is publicly documented for this device, every day between Barracuda's release and a manual rollout is a day of exposure.

RedEye Assessment

For any organization running the Email Security Gateway, this is a high-priority patch. The chain needs no credentials, the root cause is public, and attackers have exploited this device class before. The missing KEV listing reflects what has been reported so far, not the size of the risk. On the five other affected products, the command injection requires a login, so the priority depends on how well administrator credentials and the management interface are protected.

Two questions remain after patching. Was the ESG administration interface ever reachable from untrusted networks? And would the organization detect configuration restores or unexpected files on the appliance if this chain had been used before the fix?