Barracuda Email Security Gateway: pre-auth bypass (CVE-2026-116606) and command injection (CVE-2026-111560) confirmed, patch advised
CVE-2026-111560 CVE-2026-116606
Published 04/11/2026 02:15
Timeline
4 events over 1 d 8 h
- 02/11/2026 17:36UnconfirmedCommunity post+22 h
- 03/11/2026 16:06CorroboratedBleepingComputer+0 min
- 03/11/2026 16:06Confirmedtrust.barracuda.com+10 h
- 04/11/2026 02:15Published on WatchtowerPro CISO
In short
Barracuda has published a security advisory for two flaws: a pre-authentication authorization bypass in Email Security Gateway (CVE-2026-116606, 9.3 critical) and a command injection (CVE-2026-111560, 8.6 high) in several Barracuda products. Press reports say attackers could run commands with root privileges. Customers are told to patch.
How bad is it
Critical: an attacker with no login may be able to bypass authentication on Barracuda Email Security Gateway, and a command injection may let commands run with root privileges.
Confirmed by the vendor or a CERT - no exploitation reported yet.
Severity score
The worst of 2 CVEs · CVSS 4.0 from NVD, from google.com, read 04/11/2026.
What an attacker needs
- Internet access to itEnough
- A loginNot needed
- A user to clickNo
- Special settingsNo
Red helps the attacker, blue holds them back, grey is not published yet.
If it works, an attacker can
- Read the data it holds
- Change or delete that data
- Take it offline
Type: authentication bypass.
A score is the worst case for the flaw, not a verdict on any one system. How we score · ReconX customers see which of their own systems are affected.
Affected versions
- CVE-2026-116606: Barracuda Email Security Gateway (ESG).
- CVE-2026-111560: ESG, ADC, BMA, WCC, WAF and WSG, as listed in a social media post about the vendor advisory.
- Exact affected versions are not yet known from the signals.
What to do now
- Read Barracuda's advisory (trust.barracuda.com, 'Pre-Authentication Authorization Bypass and Command Injection Vulnerabilities in Certain Barracuda Products') and apply the patches it lists to every affected Barracuda product as soon as possible.
- Check which of your Barracuda appliances (ESG, ADC, BMA, WCC, WAF, WSG) are in use.
- Restrict internet access to the management interfaces of Barracuda appliances. This reduces exposure but does not make an appliance safe.
- Do not rely on information about the older CVE-2023-2868, as it is a different flaw.
ReconX customers see the full notice - and their own systems
Our customers are alerted at every phase. Until a patch exists, the ReconX agent watches their servers from the inside for anomalies, and our outside view - the attacker's view - shows which systems to fix first.
In ReconX: the full analysis, 4 open questions, followed up as sources answer and all 3 sources with their dates. And technology matching: which of your systems run Barracuda Products (unspecified), at which version, fixed or not - and what each one needs.
Main sources
Pre-Authentication Authorization Bypass and Command Injection Vulnerabilities in Certain Barracuda Products | Barracuda Networks Vendor · Barracuda warns of critical flaws allowing root access to devices Research · cR0w Community