Barracuda ESG Vulnerability Chains to Root With No Login

A Barracuda ESG vulnerability pair, CVE-2026-116606 and CVE-2026-111560, lets an attacker with no account run commands as root on Barracuda's Email Security Gateway. The fix is firmware 9.4.0.030 or later. Patching matters because this appliance sees every email your business handles, including the password resets that control your website.

What happened to Barracuda Email Security Gateway?

Researchers at watchTowr showed that two flaws in Barracuda’s Email Security Gateway (ESG) can be chained so that someone who never logs in can run commands as root. Root is the highest privilege level on the appliance, so the attacker controls the whole operating system, not just a user session.

Mandiant assigned the CVE records for both bugs:

• CVE-2026-116606, scored 9.3, is an authorization bypass. An unauthenticated attacker can restore a crafted configuration backup and rewrite the appliance’s global settings.
• CVE-2026-111560, scored 8.6, is a command injection that runs as root. On its own, it requires an administrator account.

On the ESG, the first bug supplies the access the second one needs. According to The Hacker News, which reported the story on November 6, 2026, Barracuda shipped patches on Monday of that week and watchTowr published its technical analysis and a detection tool on Thursday. watchTowr did not release an exploit.

As of November 6, neither CVE appears in CISA’s Known Exploited Vulnerabilities catalog, and no public report ties either flaw to a real attack. That gives defenders a patch window, though likely a narrow one: a detailed root-cause write-up makes it easier for others to build a working exploit.

Why should a website owner care about a mail filter? The ESG filters every message before it reaches your mailboxes. Password resets from your CMS, hosting invoices and registrar login alerts all pass through it. An attacker with root on that box can read your mail stream.

Who is actually at risk from this Barracuda ESG vulnerability?

Unauthenticated root, the serious case, applies only to Email Security Gateway appliances running firmware older than 9.4.0.030. The authorization bypass exists only in the ESG, so the full no-login chain does not work against any other Barracuda product.

Not every ESG is equally exposed. The attacker needs network access to the administration interface, which splits owners into two groups:

• Admin interface reachable from the internet: the highest risk. Anyone who can load the login page can attempt the chain.
• Admin interface limited to an internal network or VPN: an outsider would first need a foothold inside, which makes an attack much harder.

Automatic patching is a separate question. If someone switched it off, the appliance keeps running vulnerable firmware even though fixes are already available, whichever group it falls into.

The command injection, CVE-2026-111560, also affects five other Barracuda products. Public reporting does not name them, but Barracuda’s security advisory lists them along with their fixed firmware. On those products, the injection still requires administrator credentials.

An attacker who phished an admin password, guessed a weak one or already works inside the company could turn a panel login into root on the device. That is less urgent than the ESG case, but it still belongs in this month’s patch cycle.

Several questions remain open. Public sources do not say which ESG release was the first vulnerable one, whether virtual and cloud-hosted deployments behave like physical appliances, how many admin interfaces are exposed online, or when watchTowr reported the bugs to Barracuda.

Our editorial advice for virtual instances: until the advisory says otherwise, assume they are affected and patch them on the same schedule as hardware.

How does the chain work, without the exploit steps?

The chain relies on three design failures, each a well-known bug class.

1. A check that fails open

When a password change fails, the ESG does not reject the request. Instead, it gives the requester a low-privilege role. That role can reach the configuration backup-restore function, which no unauthenticated user should ever touch. Secure code fails closed: an error ends the request instead of granting access.

2. A backup checksum anyone can forge

The appliance verifies uploaded backups with a checksum, but the secret behind that checksum is hardcoded into the product. Anyone who extracts it can build a backup the appliance accepts as genuine, then restore it to change global settings.

3. A setting that becomes a shell command

One of the restored settings is the timezone. The ESG later runs that value as a shell command with root privileges. If the field holds something other than a timezone, the appliance executes it. This is the command injection half of the chain.

watchTowr demonstrated the impact by writing a file to the appliance as root. That was a proof of concept, not a weaponized tool, and we will not describe the request flow here.

Arbitrary root commands mean full control of the appliance and the mail passing through it. An attacker could read messages, copy attachments, change links or quietly forward selected mail elsewhere.

On the five other products, the authorization bypass does not exist. Only the injection remains, and it requires a valid admin session first.

Is this the 2023 Barracuda ESG hack again?

No. The 2023 incident involved a different flaw and a known attacker, and the reporting on the new pair says plainly that the two cases are unrelated.

In 2023, a group tracked as UNC4841 exploited CVE-2023-2868 in the ESG as a zero-day, meaning attacks began before any fix existed. That case still shapes how many admins view the ESG, but it has no link to the two CVEs patched this week.

The 2026 situation differs in the ways that matter:

• The fix arrived before public disclosure, not after a breach.
• No attacker, UNC4841 or anyone else, has been tied to CVE-2026-116606 or CVE-2026-111560.
• There is no public evidence that either flaw was used before the patch.

Treat this as an urgent patching task, not a reason to replace hardware. There is one exception. If your admin interface was open to the internet and you find signs of tampering (configuration changes nobody made, unknown admin accounts, unexpected files), switch to incident response and contact Barracuda support before you trust the device again.

Which Barracuda ESG firmware update fixes it, and what else should you do?

Upgrade every Email Security Gateway to firmware 9.4.0.030 or later. Barracuda has released a fix for each affected product, and its advisory recommends three steps:

1. Patch or upgrade. For the ESG, install 9.4.0.030 or newer. For the five other products, use the fixed firmware listed in Barracuda’s advisory. Public reporting does not include those version numbers, so do not guess.
2. If you must wait, restrict the admin interface to trusted internal networks. Firewall rules, a management IP allowlist or VPN-only access will all work. Any of them removes the network access the chain depends on.
3. Turn automatic patching back on if someone disabled it.

After that, verify each point instead of assuming it is done:

• Read the running firmware version on the appliance itself, not the version recorded in a change ticket.
• Run watchTowr’s detection tool, which checks whether an appliance is vulnerable.
• Review the administrator accounts and remove any account you cannot explain.
• Test admin access from outside your network, for example from a phone on mobile data. If the login page loads, close that access.

Practitioner’s note: In external tests, we often find mail and security appliances with their management page open to the internet, usually left over from a migration or a vendor support session. Just as common: auto-update switched off after one bad update and never switched back on. This chain thrives on exactly those two habits. Check the appliance itself, then check who can reach it.

If an MSP handles your mail filtering, ask them in writing for the firmware version and whether the admin interface faces the internet. Those two answers define your exposure.

Email gateways keep showing up in these headlines. Our coverage of the FortiMail zero-day describes a case that, unlike this one, was exploited before any patch existed.

What does a rooted mail gateway mean for your website?

A compromised mail gateway can read and change the emails that control your website. Root on the filter puts an attacker between the internet and your inbox, and most site accounts ultimately trust that inbox.

• Password resets. WordPress, Joomla, hosting panels and domain registrars send reset links by email. Whoever reads the link can take over the account.
• Invoice fraud. Changed bank details in a hosting or developer invoice are hard to spot when they arrive inside a real email thread.
• Security alerts. Login notifications and malware warnings can be deleted before anyone sees them.

None of this has been reported in connection with these two CVEs. It is a realistic scenario for an exposed, unpatched gateway, and it shows what to watch for after patching.

Look for password-reset emails you did not request, new admin users in your CMS, nameserver or DNS changes at your registrar, and new forwarding rules on mailboxes.

If your gateway’s admin page was reachable from the internet before you patched, change the passwords for your CMS admin, hosting panel and registrar. It takes little effort and blocks the most likely next steps for an attacker.

On the website side, file monitoring catches what a mail compromise could lead to, such as a rogue admin account installing a backdoor or injecting a script. Our website antivirus and monitoring watches for exactly those changes.

FAQ

What is CVE-2026-116606 on Barracuda Email Security Gateway?

It is an authorization bypass, scored 9.3, that lets an unauthenticated attacker restore a crafted configuration backup and change the appliance's global settings. Chained with CVE-2026-111560, it gives the attacker root without a login.

What version fixes the Barracuda ESG flaws?

Email Security Gateway firmware 9.4.0.030 and later. Fixed versions for the other affected Barracuda products are listed in Barracuda's security advisory.

Does CVE-2026-111560 affect other Barracuda products?

Yes, it affects five other Barracuda products, which Barracuda's advisory names. On those products, an attacker needs valid administrator credentials before the injection works.

Are the Barracuda ESG vulnerabilities being exploited?

Not according to public reporting. As of November 6, 2026, neither CVE was in CISA's KEV catalog, and watchTowr released only a detection tool, not an exploit.

How do I check if my Barracuda ESG is patched?

Read the running firmware version on the appliance and confirm it is 9.4.0.030 or later. watchTowr's detection tool can also check whether an appliance is vulnerable.

Is this the same as the 2023 UNC4841 Barracuda attack?

No. UNC4841 exploited a different flaw, CVE-2023-2868, as a zero-day in 2023. Nothing ties the new pair to that group or to any other attacker.

If your mail gateway was exposed and you want a second set of eyes on the website behind it, pick a SiteGuarding protection package that includes firewall, monitoring and cleanup.