Barracuda ESG CVE-2026-116606: Pre-Auth Root Chain, Patch and Check

For three days, the official read on the Barracuda Email Security Gateway (ESG) pair was that you needed an administrator login to use it. That read is now wrong. On November 5 Barracuda revised its advisory to say CVE-2026-116606 needs no authentication at all, only network access to the admin interface, and the same day watchTowr Labs published the chain that turns it into remote root. If your team triaged this bulletin on Monday as an admin-only problem and queued it for the next window, re-triage it today.

The two bugs are a pre-authentication authorization bypass (CVE-2026-116606, CVSS 9.3) that affects only ESG, and an OS command injection (CVE-2026-111560, CVSS 8.6) that reaches ESG plus five other Barracuda appliances. Chained, they give an unauthenticated attacker root on the gateway. As of November 8 neither CVE is in CISA's Known Exploited Vulnerabilities (KEV) catalog, and no public report ties either one to an attack.

What changed between the first advisory and the second?

Barracuda published patches and the advisory on November 2. The authentication field for CVE-2026-116606 originally read "Yes, administrative access". The November 5 update changed it to "No (Administrative UI Access Required)" and added a line saying authentication is not required. That one field is the difference between a bug that needs stolen credentials and a bug that needs only a reachable login page.

The sequence above is three days long: patches on November 2, the revised advisory and the watchTowr writeup on November 5. Public research tends to shorten the gap to mass scanning, so the quiet period between those two events was the cheap time to patch. It has passed.

How does the chain reach root without a login?

At a defender's level of detail, watchTowr describes two mistakes that line up. First, a failed admin password change does not end the request. The code hands back a low-privilege session and lets processing continue, which leaves a configuration backup restore function reachable by someone who never logged in. Second, a restored backup can carry a timezone setting that the appliance later passes to a shell helper running as root.

Backups do carry an integrity checksum, but watchTowr reports the secret behind it is hardcoded, which in its analysis meant the check did not stop a crafted file. Barracuda's fix replaced the shell call with plain file handling and validates the timezone against the system zoneinfo directory. watchTowr published a detection artifact generator on GitHub; it has not released a working exploit.

Which appliances and versions are affected?

Every ESG build before the fix is exposed to the full unauthenticated chain. The five other products carry only the command injection, which still requires an admin account on those boxes.

• Email Security Gateway: both CVEs. Patch BNSF-40425 for firmware 9.4.017 and later, BNSF-40430 for anything older. watchTowr tested 9.4.0.027 as vulnerable and reports the fix in 9.4.0.029; The Hacker News cites 9.4.0.030 and later. Treat 9.4.0.030 as the safe floor until Barracuda publishes a version number of its own.

• Load Balancer ADC and Web Application Firewall: CVE-2026-111560 only, patch BNADC-16586.

• Message Archiver: CVE-2026-111560 only, patch BNMA-32468.

• WAF Control Center: CVE-2026-111560 only, patch BNWF-60060.

• Web Security Gateway: CVE-2026-111560 only, patch BNYF-24789.

Barracuda notes that patches are often applied automatically, and that an appliance several firmware releases behind may need more than one update to get there. Those two facts point at the same risk group: the gateways where someone switched auto-patching off, usually to control change windows, are exactly the ones still unpatched today.

Why a quiet KEV status is weak comfort on this product

ESG has history. In 2023 a group tracked as UNC4841 exploited CVE-2023-2868 in the same appliance line as a zero-day, and Barracuda went on to recommend that impacted customers replace compromised appliances rather than rely on a patch. Nothing links that campaign to this pair. The lesson that carries over is narrower: email gateways sit on the internet, see every inbound message, and run with broad privileges, so they draw attackers who are patient and who persist below the level a firmware update cleans up.

Command injection is also not a rare class for us to see. In our own 90-day triage record, command injection and remote code execution make up 2,627 logged items, second only to cross-site scripting. What makes this one different is the location: a box most teams treat as a sealed appliance and rarely look inside.

Patching closes the hole. Here is how to check the window.

A patched gateway tells you nothing about a restore that happened before you patched. If your ESG admin interface was reachable from the internet at any point since early November, or for longer if you run old firmware, check the appliance for signs of an unexplained configuration restore. These are the components and artifacts watchTowr names in its analysis.

Admin endpoint:      /cgi-mod/index.cgi  (POST)
Password-change flow: /cgi-mod/password_change.cgi
Audit events:        failed_password_change  followed by restore activity
Restore log message: "Starting restore opertation..."   (typo is in the product)
Restore staging dir: /mail/tmp
Timezone files:      /home/product/code/config/tz
                     /etc/sysconfig/clock
Flag file:           /tmp/bypass_password
Backup contents:     backup.xml with a Spam_Config component

The pattern to worry about is a failed password change from an unfamiliar source address followed by a restore nobody on your team ran, or a timezone file whose contents are not a plain zone name. As of November 8, neither Barracuda nor watchTowr has published log file locations or indicators of compromise, so treat this as a triage checklist, not a signature set. It is the same discipline as any threat hunt: start from what the bug would have changed on disk, then look for it. If you find a restore you cannot explain, treat the gateway as compromised: the 2023 precedent says a firmware update alone may not be enough.

What to do on each kind of Barracuda box

1. ESG with an internet-reachable admin interface: patch first, then run the artifact review above. Move the admin UI behind a VPN or an allowlist of management addresses, which is Barracuda's own interim advice.

2. ESG with the admin UI internal only: patch this week. Your exposure is reduced, not gone, since anything inside the network that can reach the UI can run the chain.

3. The other five products: patch on your normal cycle, sooner if admin credentials for them are shared or have shown up in phishing.

4. Any appliance with auto-patching disabled: turn it back on, or record who owns manual updates for it. That is the population this advisory is really about.

We have written before about security appliances turning into the riskiest bugs of the week and about attackers living off the patch backlog on edge devices. The SiteGuard command injection to root and the Ivanti Sentry patch-then-hunt case follow the same shape. The Barracuda pair fits it: a filtering box trusted by default, a flaw that skips the login, and a patch that only protects you from now on.

Primary sources: Barracuda's advisory, watchTowr Labs' analysis, and coverage from The Hacker News.