Barracuda Email Security Gateway flaws let attackers gain root access without l…

What happened

On November 2, 2026, Barracuda Networks released fixes for two serious flaws in the Barracuda Email Security Gateway (ESG). This is the appliance that sits in front of a company’s mail and decides which messages are spam, which carry malware and which get through. The first flaw, CVE-2026-116606, lets an attacker bypass the login. The second, CVE-2026-111560, lets an attacker slip in system commands that run with the highest privileges (root).

A few days later, the security firm watchTowr published a technical analysis. It shows that by chaining the two flaws, an attacker can reach root without logging in at all. watchTowr did not release exploit code, only a tool that checks whether an appliance is vulnerable.

As late as November 6, 2026, The Hacker News reported that no attacks were known. That changed on November 10, 2026: the US agency CISA added both flaws to its catalog of actively exploited vulnerabilities (KEV), and ENISA’s European vulnerability database EUVD has listed them as exploited since the same day. It is not yet publicly known who is behind the attacks.

Why it is dangerous

The first flaw is an authorization bypass. Picture a doorman who, after you fail to change your password, doesn’t show you out but lets you stay inside the building. According to watchTowr’s analysis, the appliance doesn’t stop the request after a failed password change, so an unauthenticated attacker on the internet can reach the function that restores the configuration from a backup. As NVD describes it, the attacker can then upload a tampered backup and change the appliance’s global settings.

The second flaw is an OS command injection. The appliance takes the value from the timezone setting and later uses it in a system command without proper checks. It’s like someone writing an instruction for the staff into a form where a city name belongs, and the staff obediently carrying it out. On its own the flaw requires an administrator account, but the commands run as root. On the ESG, the first flaw takes the place of that account.

Root on a mail gateway means full control of the device. An attacker could read or redirect the mail passing through it, change filtering rules and use the appliance as a stepping stone into other parts of the network.

CVSS is a severity scale from 0 to 10. Both scores were assigned by Mandiant (Google), which created the CVE records, using CVSS version 4.0: CVE-2026-116606 scores 9.3 (critical), CVE-2026-111560 scores 8.6 (high).
CISA KEV is the list of flaws that the US agency CISA knows are being exploited in real attacks. It gave US federal agencies until November 13, 2026 to fix them. CISA does not yet know whether ransomware groups are using them.
EPSS estimates the probability of exploitation in the next 30 days. As of November 10, 2026 it was 1.6% for CVE-2026-116606 and about 1.1% for CVE-2026-111560. Since CISA has already confirmed exploitation, this estimate matters less.

Who is affected

The login bypass (CVE-2026-116606) affects only the Barracuda Email Security Gateway in versions earlier than 9.4.0.030. This is the only product where the two flaws can be chained into an attack without login.

The command injection (CVE-2026-111560) affects, according to Barracuda’s advisory as quoted by watchTowr, these products in addition to the ESG:

Barracuda Load Balancer ADC
Barracuda Message Archiver
Barracuda WAF Control Center
Barracuda Web Application Firewall
Barracuda Web Security Gateway

On these five products, The Hacker News notes, an attacker still needs an administrator account. The risk is lower but not zero, for example if someone knows or steals an admin password.

The ESG sits at the network edge in front of the mail server, and it is usually reachable from the internet because it receives mail. Neither watchTowr nor The Hacker News mentions any other Barracuda products in connection with these flaws.

How to check if you are affected

You’ll find the firmware version in the appliance’s web admin interface, usually on the Advanced > Firmware Update page. For the ESG, anything below 9.4.0.030 is vulnerable. For the other products, compare your version with the list of fixed firmware in Barracuda’s security advisory.

Watch out for a version mix-up: the table in watchTowr’s analysis lists 9.4.0.029 as fixed, but NVD and The Hacker News treat all versions earlier than 9.4.0.030 as vulnerable. Only consider 9.4.0.030 and later as fixed.

Also check whether the admin interface is reachable from the internet. From a computer outside your company network (for example over a mobile connection), run this request, which changes nothing. Port 8000 is the usual default. Use the one you have configured:

curl -s -o /dev/null -w "%{http_code}\n" --max-time 10 http://gateway.example.com:8000/

If you get an HTTP code such as 200 or 302, the admin interface is reachable from the internet. A result of 000 means no connection was made. watchTowr has also released a tool that checks for the vulnerability. Only use it on your own devices.

How to fix it

Barracuda has released fixes for all affected products. The ESG is fixed in version 9.4.0.030 and later, and the fixed firmware for the other products is listed in the vendor’s security advisory. Since CISA has confirmed exploitation, don’t put this off.

Recommended steps, in this order:

Start with the ESG, because there the attack needs no password at all.
If you can’t update right away, restrict access to the admin interface to trusted internal networks only. Barracuda recommends this as a temporary measure.
Install the patch or upgrade the firmware to the fixed version, then confirm the appliance reports the correct version.
If you had automatic patching turned off, switch it back on, as the vendor advises.
Next, update the other affected Barracuda products and change administrator passwords, especially if the admin interface was reachable from the internet.
Finally, check whether the appliance was compromised before you patched it (see the next section).

CISA requires US federal agencies not only to patch but also to perform a forensic check of their devices, and to stop using the product if mitigations are unavailable. This isn’t mandatory for companies in Europe, but it’s a sensible benchmark.

What if you may already be compromised

Patching closes the door, but it won’t throw out someone who is already inside. The attack grants root, so an attacker could have left a backdoor that the update won’t remove. Neither CISA nor The Hacker News lists specific indicators of compromise (IoCs) yet, so keep an eye on Barracuda’s advisory. In the meantime, look for:

configuration restores or imports from backup in the admin logs that nobody on your team performed,
failed password change attempts from unknown IP addresses,
unusual values in the timezone setting,
unknown administrator accounts, changed mail routing, forwarding or new filtering exceptions,
unusual outbound traffic from the appliance to unknown addresses.

If you find anything, or the admin interface was exposed to the internet and you can’t rule out a compromise, contact Barracuda support and bring in an incident response specialist. Don’t delete logs or reinstall the appliance until an expert has secured the evidence. For the ESG this isn’t theoretical: in 2023 the group UNC4841 exploited a different flaw (CVE-2023-2868), and according to watchTowr affected appliances had to be physically replaced. That case is unrelated to the new flaws.

Sources

Articles are put together by an AI agent from public sources (vendors, CISA, ENISA, NVD, SK-CERT, NÚKIB), and version numbers and CVEs are checked against them automatically. Always confirm the steps in the vendor advisory before touching production.

Barracuda Email Security Gateway flaws let attackers gain root access without logging in