Barracuda Networks is your new best friend (Barracuda Email Security Gateway Pre-Auth Remote Root RCE CVE-2026-116606 / CVE-2026-111560)

watchTowr Labs details how two newly disclosed flaws in Barracuda appliances can be combined for unauthenticated, root-level code execution. CVE-2026-116606 (CVSS 9.3) is an authentication bypass in the password-change flow of Barracuda Email Security Gateway that lets an unauthenticated request keep a low-privileged session role instead of being rejected. Paired with CVE-2026-111560 (CVSS 8.6), an OS command injection in the timezone-restore logic triggered via a crafted backup file uploaded through the bayesian-upload endpoint, an attacker can inject shell commands executed via sudo as root. The researchers show the backup's integrity check can be bypassed because its checksum secret is hardcoded in the firmware, letting them forge valid malicious backups. Affected products include Barracuda ESG, Load Balancer ADC, Message Archiver, WAF Control Center, Web Application Firewall and Web Security Gateway, all fixed in version 9.4.0.029, and organizations running earlier builds should update immediately given Barracuda's history of real-world exploitation of ESG flaws.