CVE-2026-116606: Barracuda ESG Bug Chain Gives Root Access

Unpatched Barracuda Email Security Gateway appliances can be taken over as root by an attacker who never logs in. watchTowr Labs has now published a step-by-step breakdown of how two flaws Barracuda patched this week chain together.

The first flaw is CVE-2026-116606, a pre-authentication authorization bypass in the Email Security Gateway (ESG). Mandiant, which assigned the CVE record, scores it 9.3 (Critical) on CVSS 4.0. The second is CVE-2026-111560, an OS command injection scored 8.6 that runs attacker commands as root. Only the ESG has the bypass. The injection also exists in five other Barracuda products, but on those it still requires an administrator account.

Barracuda released fixes on Monday, November 2, in an advisory covering six products. On November 5, watchTowr researcher Sina Kheirkhah published an analysis of the patches. It shows that a deliberately failed password change, a forged backup file, and a booby-trapped timezone string are enough to get a root shell.

As of November 6, neither CVE is listed in CISA’s Known Exploited Vulnerabilities (KEV) catalog, and no vendor has reported attacks. Sources disagree on which ESG firmware build fully closes the bypass: 9.4.0.029 or 9.4.0.030.

How the Barracuda ESG Exploit Chain Works

CVE-2026-116606 lives in the ESG’s Index.pm request handler. watchTowr found that when a password change fails, the _process_params function builds a JSON error response and then returns the current user role instead of ending the request. Processing carries on with the low-privilege role assigned to the login screen. An attacker triggers this by sending a POST request to /cgi-mod/index.cgi with mismatched new_password and retype_password fields. The appliance returns HTTP 200 with a JSON body reporting the failure, but the rest of the request still runs.

That leftover processing reaches the bayesian_upload_handler, an upload routine named after the ESG’s Bayesian spam filter. The handler accepts a pu_bayesian_upload parameter and a file, then passes the file to Barracuda::Backup2::restore_all, the appliance’s full configuration-restore routine. Mandiant’s CVE record describes the result as an unauthenticated attacker restoring “a crafted, compatible backup archive” and rewriting the appliance’s global configuration.

Barracuda backups do carry an integrity check: each file’s checksum is an MD5 hash of the file bytes plus a secret value. watchTowr found that the secret is hardcoded, so anyone who knows it can produce checksums the appliance accepts as valid.

CVE-2026-111560 is the second half of the chain. The forged backup’s Spam_Config component loads a MySQL dump that restores the system_timezone setting. Two pieces of code then put that value into a sed shell command run through Perl backticks: finalize_restore in Backup2.pm, and the fix_tz.pl script, which runs as root through sudo. The value was wrapped in single quotes, which don’t stop shell metacharacters, so a timezone string such as UTC#';touch /tmp/watchTowr;# breaks out of the quotes and runs as root. watchTowr demonstrated the chain by writing that file to the appliance.

Barracuda’s fix replaces both sed calls with Perl file reads and writes. It also rejects any timezone that doesn’t exist under /usr/share/zoneinfo/. The bypass patch changes Index.pm, Backup2.pm, bayesian_upload.pm, UserRole.pm and Params.pm. watchTowr compared vulnerable build 9.4.0.027 with patched build 9.4.0.029.

Why Barracuda Calls CVE-2026-116606 “High” and Mandiant Calls It Critical

Barracuda’s own advisory rates CVE-2026-116606 “Severity: High” alongside its 9.3 score. It also lists “Authentication Required: Yes, administrative access” for both CVEs. Mandiant’s CNA record contradicts that line. Its vector, CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N, means no privileges and no user interaction are needed. The record classifies the bug as CWE-288, authentication bypass through an alternate path.

BleepingComputer reported on November 6 that Barracuda had since clarified that attackers do not need admin privileges. The “administrative access” line therefore means network reach to the admin interface, not a password. CISA’s enrichment of the CVE record marks the bypass as automatable, with total technical impact.

watchTowr also found a 9.8 Critical rating in a comment inside Barracuda’s patch. The researchers suggest it reflects both bugs scored together but say this is their guess. NVD had not published its own score as of November 4.

Which Barracuda Products Have a Fix

Barracuda has released patches for all six affected products. The table lists the patch IDs from Barracuda’s advisory and the affected versions given in the CVE records.

For the ESG, sources disagree on the fixed build. Mandiant’s CVE record says CVE-2026-116606 affects versions earlier than 9.4.0.030. Barracuda’s Campus remediation page and watchTowr’s analysis both name 9.4.0.029 as the patched build. Barracuda has not explained the difference, so admins should treat 9.4.0.030 as the target and confirm with Barracuda Support if 9.4.0.029 is the newest build their appliance is offered.

Mandiant’s disclosure timeline shows Barracuda reported CVE-2026-111560 on Thursday, October 15, and CVE-2026-116606 on Thursday, October 22. Both records went public with the patches on November 2.

Is CVE-2026-116606 Being Exploited?

As of November 6, Barracuda, Mandiant and CISA have not reported exploitation of CVE-2026-116606 or CVE-2026-111560, and neither CVE is in the KEV catalog. Barracuda has not published indicators of compromise.

watchTowr has not released a weaponized exploit. Instead, it published a Detection Artefact Generator on GitHub so organizations can check whether their appliances are exposed. Its write-up does document the vulnerable endpoint, the six multipart fields the request needs, the checksum scheme and an example payload, along with a video demonstration.

The ESG has been attacked before. In 2023, a China-linked group Mandiant tracks as UNC4841 exploited a different ESG flaw, CVE-2023-2868, as a zero-day, and Barracuda told affected customers to replace their appliances. Nothing public connects the new flaws to UNC4841 or any other actor.

What Barracuda ESG Admins Should Do Now

To check the firmware version, go to ADVANCED > Firmware Update and read “Current Installed Version”. Update to ESG 9.4.0.030 or later and apply BNSF-40425, or BNSF-40430 on builds older than 9.4.017. Barracuda’s advisory also asks customers who disabled automatic patching to turn it back on. Owners of the other five products should apply the patch ID listed for each one in the table above.

Barracuda’s only listed workaround for appliances that can’t be patched right away is to restrict the administration interface to trusted internal networks. On the ESG, that means filling in the Administrator IP/Range field under BASIC > Administration and blocking the web interface port, HTTP 8000 by default, at the perimeter. The chain requires network access to that interface, so an ESG whose admin panel is reachable from the internet is the highest-priority fix.

Teams that want to confirm exposure can run watchTowr’s Detection Artefact Generator against appliances they own. Based on watchTowr’s analysis, a successful attack leaves two traces: a configuration restore that no administrator started, and a timezone value containing shell characters.