Two flaws in Barracuda's Email Security Gateway (ESG), the appliance many organizations put in front of their mail to filter spam and malware, can be chained by an attacker with no password into running commands as root, according to new research from watchTowr Labs by Sina Kheirkhah (@SinSinology). Barracuda has shipped fixes, and watchTowr has now published the technical detail along with a detection tool, so unpatched appliances should be treated as a priority.
The ESG has history. It is the product that had to be physically replaced after the group Mandiant tracks as UNC4841 exploited CVE-2023-2868 as a zero-day. watchTowr's post does not report exploitation of the new pair in the wild, but appliances that sit at the network edge and inspect every message are exactly what attackers go looking for.
A failed password change that keeps going
The first bug, CVE-2026-116606, is rated 9.3 (critical) in Barracuda's advisory, which calls it a pre-authentication authorization bypass. watchTowr traced it to the appliance's password-change handler. When a password change fails, the vulnerable code sends an error message back but does not actually stop the request, so the rest of the request handling carries on. The NVD record spells out the result: an unauthenticated remote attacker can invoke a configuration-import function and restore a crafted backup archive, modifying the appliance's global configuration.
The second bug, CVE-2026-111560, is an OS command injection rated 8.6 (high). It sits in how the appliance writes the system timezone after a backup restore. The timezone value is dropped into a shell command, so a value with a quote and a semicolon appended runs whatever follows it. Because the helper script that applies it is launched with sudo, the injected command runs as root. Barracuda's advisory lists this flaw across the ESG, Load Balancer ADC, Message Archiver, WAF Control Center, Web Application Firewall and Web Security Gateway.
Why the backup checksum did not help
Each file inside a backup carries a checksum the appliance verifies before restoring it. watchTowr found the checksum is an MD5 of the file plus a fixed secret string built into the product, which gave the post its title: the secret is the phrase "Barracuda Networks is your new best friend". Knowing it, the researchers built a backup the appliance accepts, planted a malicious timezone value in its configuration data, and uploaded it through an unauthenticated request that also triggers the failed password change. A single HTTP request chains the two bugs.
Update ESG to 9.4.0.029 or later, today
watchTowr's summary of Barracuda's advisory lists 9.4.0.029 as the fixed release for both flaws, while the NVD entry for CVE-2026-116606 describes versions earlier than 9.4.0.030 as affected. Administrators should move to the newest available build rather than stop at the minimum. Owners of the other Barracuda products named for CVE-2026-111560 should check the vendor advisory for their own fixed versions. watchTowr has published a Detection Artefact Generator on its GitHub so defenders can test their own appliances.
It is also worth asking whether the appliance's web management interface needs to be reachable from the internet at all. The chain starts with a request to that admin endpoint, and an appliance that does not expose it is out of reach of this particular attack.
Email gateways exist to be the most suspicious box in the building. This research is a reminder that the box trusted to judge every message deserves the same scrutiny itself.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.