Barracuda patches released Monday, November 2, 2026; watchTowr analysis published November 5, 2026; coverage November 6, 2026
No Login, Full Root: Two Barracuda Flaws Chain Into Command Execution on the Email Security Gateway
Two flaws in Barracuda's Email Security Gateway chain into unauthenticated root command execution, watchTowr showed in an analysis published November 5, working from the patches Barracuda released on Monday. The first, CVE-2026-116606, is a pre-authentication authorization bypass rated 9.3: when a password change fails, the appliance returns a low-privilege role instead of stopping the request, which leaves a configuration backup restore function reachable without a login. The second, CVE-2026-111560, is a command injection rated 8.6: a timezone value inside a restored backup is later passed to a shell command that runs as root. The backup checksum that should block a forged restore relies on a secret built into the code, so an attacker can compute a valid one. Mandiant assigned both CVE records. The bypass affects only the Email Security Gateway; the command injection reaches five other Barracuda products, where it still requires an administrator account. Reporting on the advisory lists the gateway as fixed in firmware 9.4.0.030 and later, and watchTowr diffed vulnerable 9.4.0.027 against the patched 9.4.0.029 build. As of this week neither flaw is in the CISA KEV catalog and no public report ties either to an attack; watchTowr published a detection tool and has not published an exploit. The gateway model carries history: in 2023 a group tracked as UNC4841 exploited a different flaw, CVE-2023-2868, as a zero-day, a case the current reporting stresses is unrelated.
Executives
An email gateway sits in front of every message an organization sends and receives, and this chain reaches its highest privilege with no credentials at all. There is no report of attacks yet, which is precisely the window in which patching is cheap: the technical analysis is public, the mechanism is understood, and the gap between publication and exploitation is the asset. Ask one question: is every Barracuda appliance in the estate on fixed firmware today, and if automatic patching was ever turned off, has it been turned back on.
CIO / CISO
Patch the Email Security Gateway first, then work the other five products named for the command injection, where the flaw needs an administrator account and so ranks behind the gateway. Until a unit is patched, restrict its administration interface to trusted internal networks, as the advisory directs. Because the chained result is root on a mail-path appliance, treat any gateway that was reachable and unpatched as a review candidate: check for configuration restores and global setting changes nobody scheduled, and run the detection tool watchTowr released before you close the item.
Engineers
Confirm the fixed firmware on the appliance itself, not in the change ticket, and note which fixed build your advisory copy names, since 9.4.0.029 and 9.4.0.030 both appear in this week's materials. The mechanism matters for your detections: a failed password change that proceeds instead of stopping, followed by a backup restore, is the sequence to alert on. Review restored configurations and timezone settings on any unit that ran vulnerable firmware, since the injection rides inside a restored value rather than arriving as an obvious payload.
Everyone (non-IT)
Nothing here asks anything of individual mailbox users. If your workplace uses a Barracuda gateway, mail keeps flowing while the appliance is patched, and a short maintenance window is the expected shape of the fix. The habit worth keeping is the general one: security appliances need updates as promptly as laptops do, and the team that runs yours may welcome being asked whether this one is scheduled.