Vulnerability · critical · CVSS 9.3
Barracuda Email Security Gateway flaws chained for root access and exploited
Tier A · Patch today – Before you go home
Who’s exposed: Organisations running Barracuda Email Security Gateway appliances
Tier A because: Core infrastructure or popular tool AND remote, no login AND full takeover
Reach
Attack
Damage
Fix
Popular tool · Public exploit · Remote, no login · Full takeover
What to do
- Apply the patches Barracuda released for the Email Security Gateway appliance
The Brief
- Two flaws in Barracuda's Email Security Gateway, an authentication bypass and a command injection, can be chained to run commands as root.
- The chain needs no login, according to watchTowr Labs, which detailed the attack.
- Barracuda released patches for the flaws.
Why it matters
An unauthenticated path to root on an internet-facing email gateway gives an attacker full control of the appliance, including the mail it filters, so affected appliances should be patched promptly.
The checklist behind the tier
Checklist · 5 of 10 yes
| Yes | Hits tech teams | Judgment: email security gateway appliances are network security infrastructure that IT and ops teams run. |
| No | Core infrastructure | Judgment: a single vendor's email gateway appliance, not foundational software nearly every team runs. |
| Yes | Popular tool | Judgment: Barracuda ESG is a widely deployed enterprise email security appliance. |
| No | Exploited in the wild | The Hacker News: researchers 'demonstrate' the chain; no source reports observed attacks. |
| Yes | Public exploit | watchTowr Labs: published a detailed write-up of the pre-auth remote root RCE attack chain. |
| Yes | Remote, no login | CVSSCVE-2026-116606: CVSS 9.3 – network, no privileges, no user interaction |
| Yes | Full takeover | CVSSCVE-2026-116606: CVSS rates confidentiality and integrity impact high |
| No | Secrets exposed | No source reports credentials, configs, or customer data being stolen or exposed. |
| No | Supply chain | No source reports malicious code shipped through a trusted channel or compromised update. |
| No | No fix yet | The Hacker News: the company released patches on Monday, so a fixed version exists. |
The official record
From CVE.org, CISA’s Known Exploited Vulnerabilities catalog, FIRST EPSS and the GitHub Advisory Database. Where these answer a checklist fact, they win over the reporting.
CVE-2026-116606 ↗CVSS 9.3 critical AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Authentication Bypass Allows Global Configuration Restore in Barracuda Email Security Gateway
- Exploited
- Not in CISA’s exploited catalog
- EPSS
- 1.6% chance of exploitation in the next 30 days · higher than 76% of all CVEs
- Weakness
- CWE-288
CVE-2026-111560 ↗CVSS 8.6 high AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
OS Command Injection in Barracuda Appliances
- Exploited
- Not in CISA’s exploited catalog
- EPSS
- 1.1% chance of exploitation in the next 30 days · higher than 65% of all CVEs
- Weakness
- CWE-78
Timeline
SecurityWeek reports that an authentication bypass and a command injection flaw can be chained for root access
SecurityWeek
Barracuda ESG Authentication Bypass Flaw Opens Path to Root
watchTowr Labs publishes the detailed pre-auth remote root attack chain
watchTowr Labs
Barracuda Networks is your new best friend (Barracuda Email Security Gateway Pre-Auth Remote Root RCE CVE-2026-116606 / CVE-2026-111560)
The Hacker News
Experts Demonstrate Barracuda Email Security Gateway Chain Enabling Root Access Without Login
BleepingComputer
Hackers now exploit critical Barracuda ESG flaws to gain root access
Full coverage · 4 sources
First seen · 4 sources · Full story page · How tiers are decided