watchTowr chained a login-handler bypass, a crafted backup restore and a timezone-field injection to root on Barracuda ESG. Patches shipped 2 November; five more products carry the root flaw.
Two Barracuda vulnerabilities, CVE-2026-116606 and CVE-2026-111560, can be chained to take over an Email Security Gateway (ESG) as root, according to a write-up and detection tool published by watchTowr on 5 November 2026. Barracuda published patches on 2 November. Neither flaw is reported as exploited in the wild, but the chain is now documented in code-level detail, so patching should not wait.
What is affected
CVE-2026-116606 is an authorization bypass in ESG's configuration-import function. NVD rates it CVSS v4.0 9.3 (CWE-288) and lists all versions earlier than 9.4.0.030 as affected. It affects ESG only.
CVE-2026-111560 is a command injection in the timezone configuration field, rated 8.6 (CWE-78). It needs administrator access and runs commands as root. Barracuda lists it against six products. NVD gives the versions up to and including which each is affected:
CVE-2026-116606 scores 9.3 and CVE-2026-111560 scores 8.6 on CVSS v4.0; a patch comment cited by watchTowr says 9.8.
| Product | Up to and including | Patch |
|---|---|---|
| Email Security Gateway | 9.4.0.27 | BNSF-40425 (9.4.017+), BNSF-40430 (<9.4.017) |
| Load Balancer ADC | 6.4.0 | BNADC-16586 |
| Web Application Firewall | 11.0.1 | BNADC-16586 |
| Web Security Gateway | 16.1.100.100 | BNYF-24789 |
| Message Archiver | 5.5.4.0 | BNMA-32468 |
| WAF Control Center | 2.2.1 | BNWF-60060 |
Only ESG can be taken from unauthenticated to root through the chain. On the other five products the timezone flaw is a privilege escalation for someone who already has admin access.
Barracuda's advisory does not say whether cloud-hosted services are affected, and it does not separate appliance from virtual deployments. The patch IDs and firmware versions refer to the product firmware, so treat self-managed appliances and virtual machines as in scope and ask Barracuda to confirm the status of any hosted service.
How the chain works
According to watchTowr, the first step is a logic error in the login handler. A request to POST /cgi-mod/index.cgi with mismatched new_password and retype_password values triggers the failed-password-change path. The code sent a JSON error but returned a role value instead of ending the request. Processing carried on into module handlers under the low-privilege login-screen role. The fix ends the request through _bailout_with_json_login_response.
The second step uses a backup-upload handler reachable this way. It accepts an uploaded tar archive, stages it and calls Backup2::restore_all(). A backup.xml file lists the components, and the Spam_Config component restores a MySQL dump, including a system_timezone row. Each file carries an MD5 checksum computed with a hardcoded string, so an attacker can precompute valid checksums for a crafted archive.
The third step is the timezone injection. finalize_restore in Backup2.pm placed system_timezone into a backtick sed command, and the single quotes did not contain a crafted value. The same value is also written to /etc/sysconfig/clock by fix_tz.pl, which runs through sudo, so injected commands execute as root. The patch validates the value against /usr/share/zoneinfo/ and replaces the shell calls with Perl file operations.
Caveats on the advisory
Barracuda's page says exploitation requires the admin UI to be reachable by the attacker, and it changed the authentication field for CVE-2026-116606 on 5 November. NVD's CISA SSVC entry, dated 2 November, records exploitation as none, automatable as yes and technical impact as total. watchTowr says one patch comment carries a 9.8 score; Barracuda lists 9.3.
Version numbers differ between sources: watchTowr names 9.4.0.027 as vulnerable and 9.4.0.029 as fixed, NVD says earlier than 9.4.0.030, and Barracuda's patch table uses 9.4.017. Confirm against the device rather than relying on a single number.
What defenders should do
- Keep the administrative interface off the public internet and limit it to trusted internal networks. This is Barracuda's own mitigation.
- Check the firmware version on each device. Barracuda says the device shows the latest available version, and a unit that is several versions behind may need more than one update.
- Apply the patch manually if it was not installed automatically, using the instructions on Barracuda Campus, and enable automatic patching.
- Apply the matching patch to ADC, WAF, WSG, Message Archiver and WAF Control Center, which carry the root-level timezone flaw.
- Run watchTowr's Detection Artefact Generator to test susceptibility and guide remediation.
- Barracuda support can verify firmware and patch state at support@barracuda.com or +1 888 268 4772.