Vulnerabilities

Barracuda email gateway flaws chain to pre-auth root, no login needed

Barracuda now confirms CVE-2026-116606 needs no login and chains with CVE-2026-111560 to root on Email Security Gateway. Patch and lock down admin access.

Illustration of a server appliance with the headline Barracuda gateway flaws chain to root access

Barracuda has confirmed that attackers need no credentials at all to chain two newly patched flaws into root access on its Email Security Gateway, provided they can reach the admin interface. With a full technical analysis now public, any UK organisation with an exposed or unpatched appliance should treat this as an emergency change.

What happened

On 2 November 2026 Barracuda Networks published an advisory covering two vulnerabilities across six of its products. CVE-2026-116606 is an authorisation bypass, scored 9.3, that affects only the Email Security Gateway (ESG). CVE-2026-111560 is an operating system command injection, scored 8.6, that sits in code shared by the ESG, the Web Application Firewall, WAF Control Center, Load Balancer Application Delivery Controller, Message Archiver and Web Security Gateway. Mandiant assigned both CVE records and, according to SecurityWeek, reported the command injection to Barracuda on 15 October and the bypass on 22 October.

The first version of the advisory was confusing. It labelled the ESG flaw as “pre-authentication” while also marking administrative access as a requirement, which led many administrators to file it under “only matters if someone already has our admin password”. On 5 November Barracuda corrected that field. The authentication requirement for CVE-2026-116606 now reads “No (Administrative UI Access Required)”: an attacker does not need an account, only network reach to the management interface.

The same day, watchTowr Labs published a detailed write-up showing how the two bugs combine into unauthenticated code execution as root on the ESG, along with a detection artefact generator that lets defenders check whether their own appliances are vulnerable. watchTowr has not released a weaponised exploit, and at the time of writing neither CVE appears in the CISA Known Exploited Vulnerabilities catalogue. Neither Barracuda nor Mandiant has said whether the flaws have been used in attacks.

The technical picture

The bypass lives in the ESG’s password change handling. According to watchTowr’s analysis of Barracuda’s patch, when a password change attempt failed, the code sent back an error message but did not actually halt the request. Instead it handed the session’s role object back to the main request handler, which carried on processing other parameters in the same request. Mandiant describes the result as the ability to invoke a configuration import routine and restore a crafted backup, modifying the appliance’s global configuration.

The command injection is in how Barracuda products apply the system timezone. The timezone value stored in configuration was dropped into a shell command without proper validation, and one of the affected scripts runs with elevated privileges, so the injected command executes as root. Combined with the bypass, that value can arrive inside a restored backup rather than needing an admin to set it.

The detail that should worry anyone who builds or buys appliances is the backup integrity check. Barracuda’s backups are protected by a checksum, but watchTowr found that the secret used to calculate it was a fixed string baked into the firmware. A secret shared by every device is not a secret, so a forged backup can pass the check.

Timeline of the Barracuda Email Security Gateway flaws from Mandiant's reports in October to the revised advisory and watchTowr analysis on 5 November 2026

Why it matters for UK organisations

Barracuda is a familiar name in British IT. BleepingComputer puts its customer base at more than 200,000 worldwide, spanning small businesses, large enterprises and managed service providers, and mail filtering appliances of this kind are often installed years ago and then left running quietly with little attention.

History matters here. In 2023 the China-linked group tracked as UNC4841 exploited a different ESG zero-day, CVE-2023-2868, from at least October 2022. Mandiant found that almost a third of the appliances compromised in that campaign belonged to government organisations, and Barracuda took the unusual step of telling affected customers to replace hardware outright. A capable state actor has already shown it knows this platform intimately and values the access it gives to an organisation’s mail flow.

The new chain is narrower than the 2023 bug, because it needs access to the admin interface rather than simply sending a malicious email. That is not much comfort. Management portals on mail filters, load balancers and WAFs are commonly left reachable from the internet, sometimes opened up for a supplier or a remote admin and never closed again. With a public write-up explaining the logic, the gap between disclosure and mass scanning is likely to be measured in days.

For UK organisations, a compromised mail gateway is also a data protection problem. It sees every inbound message and attachment. Root on that box means potential access to personal data at scale, which would bring UK GDPR breach assessment and possible ICO notification into play.

Expert view

Two things stand out to me. First, the vendor’s original wording undersold the risk. Flagging a bug as pre-authentication while also listing admin access as a requirement is contradictory, and many patch triage processes key off exactly that field. Organisations that deprioritised this on Monday or Tuesday need to revisit the decision.

Second, this is a textbook example of why exposing management planes to the internet is so dangerous. Authentication logic in appliance web interfaces is often old, complex and lightly tested, and a single missing early exit in an error path was enough to undo it. Network controls that limit who can even reach the login page are the layer that still protects you when that logic fails. The hardcoded checksum secret is a separate lesson in secure design: integrity checks need per-device keys or proper signatures, not a constant shared across every unit shipped.

Barracuda patches appliances automatically where automatic patching is enabled, so the real risk sits with organisations that disabled automatic updates, run firmware several versions behind, or have virtual appliances in forgotten corners of the estate.

What to do now

  1. Confirm patch status today. Check every ESG, WAF, Load Balancer ADC, Message Archiver, WAF Control Center and Web Security Gateway. ESG should be on 9.4.0.030 or later with the relevant patches applied (BNSF-40425 or BNSF-40430, depending on version). Devices several releases behind may need more than one update. This maps to the Cyber Essentials security update management control.
  2. Take admin interfaces off the internet. Restrict management UIs to trusted internal networks or a management VPN, as Barracuda recommends. This is the Cyber Essentials firewall control in action.
  3. Re-enable automatic patching on any appliance where it was switched off.
  4. Run watchTowr’s detection artefact generator or your own scanner against your external attack surface to confirm nothing is still exposed.
  5. Look for signs of tampering if an appliance was exposed and unpatched: unexpected configuration restores, odd timezone values, new admin users or unusual outbound connections. If in doubt, engage Barracuda support and treat the device as untrusted.
  6. Ask your MSP directly whether they manage Barracuda kit on your behalf and when it was patched.

Bottom line

This is a pre-authentication root chain on a mail security appliance that a state-backed group has targeted before, and the method is now public. Patch, lock down admin access, and verify. Assuming the auto-update took care of it is not enough.

Sources

Related Posts