Two chained Barracuda ESG flaws deliver pre-authentication root access

November 2, 2026. Barracuda ships fixes for CVE-2026-116606 and CVE-2026-111560, two flaws in its Email Security Gateway (ESG). November 5, 2026. watchTowr Labs publishes the full exploitation chain under a headline that leaves no room for doubt: “Barracuda Networks is your new best friend.” 2023. The same product line was hit by a mass-exploited zero-day, CVE-2023-2868. Why it matters: the two flaws chain into full root access, with no login at all, on the appliance that filters every piece of inbound mail you receive.

Two flaws, one outcome

CVE-2026-116606 is a pre-authentication authorization bypass rated CVSS 9.3. CVE-2026-111560 is a command injection rated CVSS 8.6. On their own, neither is enough: the second normally requires administrator privileges. The first removes that requirement. Chained, they let an unauthenticated attacker run commands as root on the gateway.

watchTowr verified the chain against firmware 9.4.0.029. Their analysis is blunt: an attacker with no account on the device can take complete control of it. Barracuda’s fix moves the release to 9.4.0.030.

A config import with no lock on the door

CVE-2026-116606 is one sentence long: the configuration-import API requires no authentication. Any remote user can invoke it and feed it a backup archive crafted to match the appliance’s configuration schema. If the archive is well formed, it overwrites the device’s global settings.

This is worse than a simple read. By overwriting settings, an attacker takes hold of the device — injecting their own values, disabling controls, or setting the stage for the second flaw, the CVE-2026-111560 command injection. The authentication barrier is not bypassed in any subtle sense: it simply is not there on this entry point.

Six products, one truly critical flaw

CVE-2026-111560 reaches beyond the ESG. Barracuda lists six products affected by the command injection. On the other five, exploitation still requires administrator privileges, so the flaw is real there but less immediate.

The table makes one point: only the ESG carries both flaws, and therefore the pre-authentication root path. It is the absolute priority.

A target already breached in 2023

This is not the first time the ESG has been at the center of a major alert. In May 2023, Barracuda disclosed that its ESG appliances had been compromised through a zero-day, CVE-2023-2868, exploited by a China-linked threat actor tracked as UNC4841. The devices were backdoored at scale, to the point that CISA and the FBI told organizations to replace them physically, not merely patch them.

The episode left a mark: ESG boxes still sit on the public internet, often with the admin interface reachable from outside. The new chain revives a risk the industry already knew too well.

What to do now

Barracuda recommends three moves, in order. First, apply the patch — for the ESG, that is BNSF-40425 on 9.4.017 or later, or BNSF-40430 below it. Second, restrict the admin interface to a trusted internal network with network access controls. Third, turn automatic patching back on if it has been disabled.

Two traps to avoid. A device that is several versions behind cannot always jump straight to the latest firmware: Barracuda advises applying updates step by step. And if the patch was not pushed automatically, it must be applied manually without delay.

To check whether a device is vulnerable, watchTowr has published a detection artifact generator on GitHub. It verifies the presence of both CVEs on the ESG.

Verdict

The Barracuda chain is no exotic bug: it is a trivial authorization bypass combined with a known command injection, on the appliance that filters all of an organization’s email. The risk is not just root — it is what root on the ESG then enables: reading mail, intercepting attachments, and rewriting filter rules to let anything through.

If you run a Barracuda ESG, apply BNSF-40425 or BNSF-40430 today and remove the admin interface from the internet — this is an incident-grade fix, not maintenance. If you manage one of the five other products, patch CVE-2026-111560, but know that exploitation there already requires an admin account. In both cases the rule is the same: an exposed email-security appliance is an appliance that eventually gets targeted.

References

• watchTowr Labs — Barracuda Networks is your new best friend (CVE-2026-116606, CVE-2026-111560)
• Barracuda — Pre-Authentication Authorization Bypass and Command Injection advisory
• Security Affairs — Two Barracuda ESG flaws could be combined for full root access (November 4, 2026)
• The Hacker News — Experts Demonstrate Barracuda Email Security Gateway Chain (November 6, 2026)
• GitHub — watchTowr-vs-Barracuda-RCE-CVE-2026-116606-CVE-2026-111560
• OpenCVE — CVE-2026-116606