Barracuda Email Security Gateway Pre-Auth RCE Discovered
Original title: Barracuda Networks is your new best friend (Barracuda Email Security Gateway Pre-Auth Remote Root RCE CVE-2026-116606 / CVE-2026-111560)
Chained CVE-2026-116606 and CVE-2026-111560 enable pre-auth remote root code execution on Barracuda ESG 9.4.0.027.
watchTowr Labs analyzed Barracuda Email Security Gateway and found two vulnerabilities that can be chained. CVE-2026-116606 is a pre-authentication authorization bypass allowing arbitrary Spam_Config restore. CVE-2026-111560 is OS command injection. Together they permit pre-auth remote root RCE. Barracuda released patches in version 9.4.0.029 fixing both.
Unconfirmed: Chained RCE impact assessed by watchTowr Labs; no public confirmation of successful attacks.
- CVSS 9.3 Critical for CVE-2026-116606
- Affects Barracuda ESG 9.4.0.027
- Fixed in Barracuda ESG 9.4.0.029
- No in-the-wild exploitation reported
- Patch-1 and Patch-2 address each CVE separately
Impact: pre-auth remote root code execution
| Product | Affected | Fixed in |
|---|---|---|
| Barracuda Email Security Gateway | 9.4.0.027 | 9.4.0.029 |
- 1.Upgrade Barracuda ESG to 9.4.0.029
- Vendors
- Barracuda
- Products
- Email Security Gateway
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-111560 | Command Injection in Barracuda Appliance Timezone Field | 8.6 | — | ||
| CVE-2026-116606 | Auth bypass in Barracuda Email Security Gateway before 9.4.0.030 | 9.3 | — |
From the original article
12 min read at labs.watchtowr.com
Yes, that's right! Today we're at the aquarium. Welcome back to yet another watchTowr Labs blog post.
By Sina Kheirkhah (@SinSinology) · labs.watchtowr.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.