Barracuda Email Security Gateway chain allows root RCE without login

Affected Systems

Barracuda Email Security Gateway (all versions prior to 9.4.0.030). CVE-2026-116606 (authorization bypass, CVSS 9.3) affects only Email Security Gateway. CVE-2026-111560 (command injection, CVSS 8.6) affects five other Barracuda products but requires admin access on those platforms.

Exploitation Status

No active exploitation reported. Not listed in CISA KEV catalog as of publication. watchTowr released a detection tool but no public exploit. No threat actor attribution.

Business Impact

Unauthenticated remote attackers can achieve root-level command execution on vulnerable Email Security Gateway appliances by chaining CVE-2026-116606 (authorization bypass via failed password change) with CVE-2026-111560 (command injection in timezone parameter). Attack leverages hardcoded checksum secret to forge malicious configuration backups. Barracuda patched on November 4, 2026; watchTowr disclosed technical details November 7, 2026. Same product line was compromised in 2023 by UNC4841 via CVE-2023-2868 zero-day.

Urgency

🔴 Immediate

Recommended Actions

• Upgrade Barracuda Email Security Gateway to firmware version 9.4.0.030 or later immediately.
• If immediate patching is not possible, restrict administrative interface access to trusted internal networks only via firewall rules or ACLs.
• Enable automatic patching on all Barracuda appliances if previously disabled.
• Run watchTowr detection tool to confirm vulnerability status of deployed Email Security Gateway appliances.
• Review Email Security Gateway logs for unauthorized configuration restore attempts, failed password change requests followed by backup uploads, or unexpected timezone parameter changes since initial vulnerability window.