Security · High impactFan score 67 · Tier A3 sources

Barracuda Networks is your new best friend (Barracuda Email Security Gateway Pre-Auth Remote Root RCE CVE-2026-116606 / CVE-2026-111560)

The Brief

Two flaws in Barracuda's Email Security Gateway, an authentication bypass and a command injection, can be chained to run commands as root.
The chain needs no login, according to watchTowr Labs, which detailed the attack.
Barracuda released patches for the flaws.

Why it matters

An unauthenticated path to root on an internet-facing email gateway gives an attacker full control of the appliance, including the mail it filters, so affected appliances should be patched promptly.

Who’s affected

Organisations running Barracuda Email Security Gateway appliances

What to do

Apply the patches Barracuda released for the Email Security Gateway appliance

CVE-2026-116606
CVE-2026-111560
#barracuda
#email-security
#authentication-bypass
#command-injection
#root-access
#vulnerability

Yes, that's right! Today we're at the aquarium. Welcome back to yet another watchTowr Labs blog post. You can begin preparing your comments now. What Is A Barracuda, And Why? Must We? Barracuda’s Email Security Gateway solution (ESG) is no stranger to love , for a…

Read the full story at labs.watchtowr.com ↗