Barracuda ESG Back in the Crosshairs: Two Chainable CVEs Enable Pre-Auth Root RCE

Barracuda's Email Security Gateway is back under the security research spotlight. On November 5, watchTowr Labs published a technical analysis of two vulnerabilities — CVE-2026-116606 and CVE-2026-111560 — that, when chained, allow unauthenticated remote code execution as root. The chain targets appliances deployed at the network perimeter, the same devices compromised in 2023 by UNC4841 via CVE-2023-2868, an incident that forced the vendor to physically replace hardware.

The Logic Flaw That Opens the Gateway

The core of CVE-2026-116606 lies in a flow error in the Index.pm file of Barracuda ESG's Perl code. When a password-change request fails with the ERROR_PASSWD_CHANGE code, the method does not terminate execution with bailout() — the correct practice for a critical error — but instead returns the $userrole object. This allows the response() method to continue processing and invoke protected module handlers.

The proof-of-concept payload is elementary: an HTTP POST to /cgi-mod/index.cgi with parameters user=admin&new_password=one&retype_password=two — mismatched passwords that guarantee failure — yields an HTTP 200 response with JSON containing success:true. No valid credentials are required. The returned role object is sufficient to pass the authorization check.

"Send the error and stop here. Returning a userrole would let response() run module handlers." — Comment in Barracuda patch code, cited by watchTowr Labs

From Valid Role to Root Shell

With authentication bypassed, the attacker accesses administrative functionality including system timezone management. This is where CVE-2026-111560 comes into play: in Backup2.pm, the pre-patch code executes a shell command via backticks to replace the TZ line in the configuration file. The $system_timezone variable is user-controllable and interpolated directly into the command string without validation.

The patch replaces the shell execution with native Perl code that verifies the timezone path against /usr/share/zoneinfo/ before use. The change confirms the nature of the flaw: this is not a complex gadget chain, but a classic command injection with user-supplied parameters passed to /bin/sh -c.

The combined effect is a complete exploit chain: the pre-auth bypass provides the session, the command injection exploits its privileges. The result is unauthenticated remote code execution as root on the perimeter appliance.

The Scoring Numbers and the Code Discrepancy

watchTowr Labs assigns CVE-2026-116606 a CVSS 9.3 Critical and CVE-2026-111560 a CVSS 8.6 High. Both vulnerabilities are marked as fixed in version 9.4.0.029. In the patch code, however, a reference to CVSS 9.8 Critical appears which, according to watchTowr's analysis, "probably reflects both vulnerabilities scored together." The researcher adds, with technical irony: "CVSS experts will quickly recognize this as a crime," referring to the practice of combining separate scores into a single non-standard value.

No official CVSS scores from the National Vulnerability Database or vendor advisories for the individual CVEs emerge in the available data. The reported numbers come exclusively from watchTowr Labs' analysis.

The Ghost of CVE-2023-2868 and Comparison with the Past

The publication revives recent memories. In 2023, CVE-2023-2868 (CVSS 9.4 Critical) was exploited by the UNC4841 group, identified by Mandiant, to compromise Barracuda ESG appliances with a zero-day format injection. The severity of the incident forced Barracuda into an unprecedented response: physical replacement of compromised appliances, not just software patching.

Operating conditions are identical. Barracuda ESG is typically exposed directly to the internet for email traffic management. The attack surface is maximal: a perimeter gateway with administrative interfaces reachable from the external network. In 2023 this exposure allowed APTs to establish long-term persistence; in 2026 the chain documented by watchTowr does not even require the complexity of a sophisticated zero-day.

The crucial difference lies in the vendor response. In 2023 the compromise was deemed so deep as to make patching unreliable; in 2026 version 9.4.0.029 delivers the fix via software. Whether this confidence reflects a different attack depth or a more mature response process is not determinable from available data.

What to Do Now

Barracuda ESG administrators must verify the installed version and plan an upgrade to 9.4.0.029 without waiting for ordinary maintenance cycles. The CVSS 9.3 severity and the pre-authentication nature of the exploit make every day of delay a calculated risk.

For CVE-2026-111560, the list of affected products is broader: beyond ESG, the Load Balancer ADC, Message Archiver, WAF Control Center, Web Application Firewall, and Web Security Gateway all require the same version 9.4.0.029. Operators of these appliances must consult the Barracuda advisory to confirm their exposure.

Organizations unable to apply the patch immediately should evaluate segmentation of administrative interface access, limiting reachability of /cgi-mod/index.cgi to authorized IP addresses. This measure does not eliminate risk but raises the cost of attack.

It is also advisable to monitor logs for anomalous POST requests to /cgi-mod/index.cgi with password-change parameters and for shell process executions by the appliance's web services. The presence of both patterns suggests attempts to replicate the documented chain.

Frequently Asked Questions

How many Barracuda products are actually at risk?

CVE-2026-116606 specifically affects Barracuda Email Security Gateway. CVE-2026-111560, according to the advisory table reported by watchTowr Labs, involves six products: beyond ESG, the Load Balancer ADC, Message Archiver, WAF Control Center, Web Application Firewall, and Web Security Gateway. Not all products are vulnerable to both CVEs.

Is the CVSS 9.8 in the patch code the official one?

No. watchTowr Labs hypothesizes that the CVSS 9.8 reference in the patch code reflects a combined scoring of the two vulnerabilities, not the official score of a single CVE. The confirmed CVSS scores for the individual vulnerabilities are 9.3 for CVE-2026-116606 and 8.6 for CVE-2026-111560, according to the same source.

Is physical hardware replacement necessary as in 2023?

The dossier documents no physical replacement recommendation for this incident. Remediation occurs via upgrade to version 9.4.0.029. Hardware replacement was specific to CVE-2023-2868, where device compromise was judged so deep as to make any software remediation unreliable.

Sources

• labs.watchtowr.com