Barracuda ESG flaws allow unauthenticated root command execution
Original title: Barracuda Email Security Gateway Flaws Allow Unauthenticated Attackers to Execute Commands as Root
CVE-2026-116606 and CVE-2026-111560 are fixed in 9.4.0.029; in-the-wild exploitation is not reported.
watchTowr Labs detailed two Barracuda Email Security Gateway flaws that can be combined so an unauthenticated attacker bypasses authentication and runs operating system commands as root. CVE-2026-116606 is a pre-authentication authorization bypass scored CVSS 9.3, and CVE-2026-111560 is a command-injection flaw scored CVSS 8.6. The injection also affects several other Barracuda products. Version 9.4.0.029 contains the fixes.
Unconfirmed: The report does not say attackers are exploiting either flaw.
- Researchers compared ESG 9.4.0.027 with patched 9.4.0.029.
- A mismatched password-change request can return a login-screen user role.
- The timezone value reaches unsanitized sed commands run through sudo.
- A crafted backup can supply system_timezone through bayesian_upload.pm.
- watchTowr published a Python detection tool on GitHub.
Impact: Unauthenticated command execution as root
| Product | Affected | Fixed in |
|---|---|---|
| Barracuda Email Security Gateway | — | 9.4.0.029 |
| Barracuda Load Balancer ADC | — | 9.4.0.029 |
| Barracuda Message Archiver | — | 9.4.0.029 |
| Barracuda WAF Control Center | — | 9.4.0.029 |
| Barracuda Web Application Firewall | — | 9.4.0.029 |
| Barracuda Web Security Gateway | — | 9.4.0.029 |
- 1.Update affected appliances to version 9.4.0.029.
- 2.Review backup restoration activity and unexpected configuration changes.
- 3.Restrict administrative interfaces and monitor suspicious command execution.
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-111560 | Command Injection in Barracuda Appliance Timezone Field | 8.6 | 1% | KEV | KEV |
| CVE-2026-116606 | Auth bypass in Barracuda Email Security Gateway before 9.4.0.030 | 9.3 | 2% | KEVPoC | KEV |
From the original article
3 min read at gbhackers.com
Two critical security vulnerabilities in Barracuda Email Security Gateway (ESG) could let unauthenticated attackers bypass authentication and run operating system commands as root. The vulnerabilities, tracked as CVE-2026-116606 and CVE-2026-111560, were detailed by security researcher Sina Kheirkhah from watchTowr Labs on November 5, 2026.
By Divya · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.