Barracuda ESG Pre-Auth RCE: How Two Flaws Chain to Root, and What to Patch

The Barracuda ESG pre-auth RCE that watchTowr Labs published on 5 November 2026 chains two flaws, CVE-2026-116606 and CVE-2026-111560, to reach root on a Barracuda Email Security Gateway. Barracuda says the pair, if used together, could let an attacker bypass authorization controls and obtain root access. Both need access to the appliance’s administrative interface, so how that interface is exposed decides your risk.

This post walks the chain at concept level, then covers detection and patching. It leaves out requests, endpoints and payloads on purpose. Our knowledge-base pages cover each flaw alone: CVE-2026-116606, the authentication bypass and CVE-2026-111560, the timezone command injection.

What Is the Barracuda ESG Pre-Auth RCE?

An Email Security Gateway sits at the edge of a mail system and decides which messages are spam, which carry malware and which get through. That position is why attackers value it. watchTowr notes that the ESG line needed physical replacement after UNC4841, according to Mandiant, used CVE-2023-2868 as a zero-day. Our SUBMARINE backdoor post covers that earlier Barracuda ESG campaign.

The two new flaws were assigned by Mandiant as the CVE numbering authority and published on 2 November 2026. The Mandiant disclosure says Barracuda reported the authentication bypass on 22 October 2026. watchTowr analysed the patches by comparing ESG 9.4.0.027 with 9.4.0.029.

Neither record carries a CVSS 3.1 score. watchTowr points out that a comment in one patch gives 9.8, which it guesses reflects both flaws scored together. This is watchTowr’s reading, not Barracuda’s.

How Does the Chain Reach Root?

We split watchTowr’s analysis into five stages, shown in order below. The ATT&CK ids are our mapping, not the researcher’s.

The first flaw is a logic error in how the login page handles a failed password change. watchTowr shows that the vulnerable code returned an error message but did not end the request. The request then continued under the low-privilege login-screen role, which was enough to reach functions that should have needed a login.

One of those functions restores a backup. A backup is an archive with a manifest and a configuration dump, and the appliance restores each part. watchTowr says the checksum on each part does not stop an attacker from building a matching archive.

The second flaw lives in the restored configuration. Two code paths took the timezone setting and handed it to a shell command. One path wrote the product’s timezone file, and the other, which runs as root through sudo, wrote the operating system’s clock file.

The patch for the second flaw checks that the timezone names a real file in the system timezone directory. It also replaces the shell command with plain file reading and writing. In our view, that makes any timezone value that is not a real zone name a useful sign of tampering.

Why Does the Admin Interface Exposure Matter?

Barracuda updated its advisory on 5 November 2026. The field “Authentication Required” for CVE-2026-116606 now reads “No (Administrative UI Access Required)”. Barracuda says authentication is not required, but the attacker must be able to reach the admin interface.

The advisory also says organizations whose administrative interfaces are not publicly accessible from the internet are less exposed. It recommends restricting administrative access to trusted internal networks. CVE-2026-111560 on its own requires administrative access, so it matters most when chained or when an attacker already holds an admin account.

The CISA coordinator entry in each CVE record dated 2 November 2026 lists exploitation as none. Neither flaw is in the CISA KEV catalogue version 2026.11.04. watchTowr says it shares a detection tool so teams can test their own appliances, and we do not link it.

Which Barracuda Products and Builds Are Affected?

CVE-2026-116606 affects only the Email Security Gateway. CVE-2026-111560 affects six product lines that share common Barracuda code. The CVE records give these affected ranges, and Barracuda names a patch for each product.

watchTowr lists 9.4.0.029 as the fixed ESG build, while the CVE record for the bypass says versions before 9.4.0.030 are affected. We cannot settle that difference from the sources. Barracuda says the device shows the latest firmware available, and that a device several versions behind may need more than one update.

How Can You Detect Abuse or Tampering?

The checks below are our reading of the patch analysis, so treat them as leads, not signatures. They assume you can read the appliance audit log and its stored configuration, and that logs go to a system the appliance cannot alter.

• Review who can reach the admin interface from the internet. An exposed interface is the precondition for the whole chain.
• Look for repeated failed password-change events against the admin login. watchTowr’s code excerpt shows the appliance records them as a failed_password_change audit event.
• Check the audit log for configuration restores that no administrator started.
• Compare the stored timezone setting with the list of real zone names. A value with extra characters is a sign of tampering.
• Watch for outbound connections from the appliance to hosts you do not expect, and for new administrator accounts or scheduled tasks.

Our advice: if you find a match on a device that was exposed and unpatched, treat it as compromised. Rotate the appliance’s admin credentials and any secrets it stores, and plan a rebuild from known-good firmware. Contact Barracuda Support for help.

What Should You Patch and Close First?

Steps 1 to 3 follow Barracuda’s guidance. Steps 4 and 5 are our advice.

The controls behind these steps are covered in our entries on attack surface, patch management, network segmentation and the technique page on exploiting public-facing applications. In our view, keeping the admin interface off the internet is the control that matters most for this chain.