If you remember 2023, you remember the Barracuda Email Security Gateway as the appliance so badly compromised that Barracuda told customers to replace it. This week's bugs are unrelated to that, and there's no exploitation reported yet. But watchTowr just published how to chain them into root without a login, and we all know how fast "published" turns into "exploited" lately.
What Happened
On November 2, Barracuda published an advisory for two vulnerabilities:
- CVE-2026-116606: a pre-authentication authorization bypass in the Email Security Gateway (ESG) only. CVSS 9.3.
- CVE-2026-111560: an OS command injection that runs as root. CVSS 8.6. It requires an admin account, and it affects ESG plus Barracuda's ADC, BMA, WCC, WAF and WSG products.
On their own, the second bug needs admin access. On the ESG, the first bug hands you that access. On November 5, watchTowr published the full chain.
How the Chain Works
This is one of those write-ups where each step is small and the result is total:
- The bypass. When a password change fails, the code sends back an error but, in watchTowr's words, "doesn't actually stop execution." It keeps going with a low-privilege role, which is enough to reach functions that should require a login.
- The delivery. One of those reachable functions is an upload handler that leads to backup restore. The backup's integrity checksum is built with a secret that watchTowr says is hardcoded, so an attacker can forge a valid one.
- The injection. The restored backup includes a timezone setting that later gets dropped into a shell command run with sudo. Put a command in the timezone, get root.
All of it fits in a single HTTP request. watchTowr demonstrated writing a file as root and released a detection tool, not a weaponized exploit.
Barracuda updated its advisory on November 5 to clarify that exploitation requires the administrative UI to be reachable. That's the whole ballgame.
Credit Where It's Due
Barracuda patched before the details went public, published patch IDs for every affected product, and corrected its own advisory when the access requirement needed clarifying. That's how it's supposed to go.
The Architecture Point
I keep writing versions of this post because the pattern keeps repeating: the management interface of a security appliance is the way in. Zyxel switches this week. Palo Alto and the PHP2Shell chain last week. Ivanti before that. Every vendor ships bugs, Zscaler included (I work there, so weigh my bias). The question is how much of that code an attacker can reach.
And Microsoft published a number this week that should keep appliance owners up at night: in its data, the median vulnerability on network appliances takes "beyond a year" to patch. A pre-auth root chain plus a one-year patch cycle is not a great combination.
What To Do
- Patch now. Confirm your ESG has BNSF-40425 (9.4.017 and later) or BNSF-40430 (earlier builds). The advisory lists the patch for each of ADC, BMA, WCC, WAF and WSG. watchTowr lists 9.4.0.029 as fixed for the ESG.
- Check that auto-patching actually ran. Barracuda calls out applying patches manually if they didn't land. Don't assume.
- Get the admin UI off the internet. Barracuda's own recommendation is to restrict it to trusted internal networks. Without a reachable admin UI, this chain doesn't start.
- Run watchTowr's detection tool against your appliances if they were exposed, and review logs for unexpected backup restores.
- Patch the other five products too. The command injection still needs admin access there, but stolen admin passwords are not exactly rare.
Bottom Line
No exploitation reported yet, and there's a public roadmap. Patch, verify the patch, and make sure the only people who can reach an appliance's admin page are the people who administer it.
Sources: Barracuda security advisory, watchTowr Labs, The Hacker News, and Microsoft Security on time to patch