watchTowr chains Barracuda ESG auth bypass and command injection to pre-auth root
The researchers diffed Barracuda's own patches for two ESG flaws and found a failed password change that doesn't stop execution, plus a timezone field that reaches a shell.
watchTowr Labs has published an analysis of two Barracuda Email Security Gateway flaws, CVE-2026-116606 and CVE-2026-111560, and says they can be chained into pre-authentication remote code execution as root. The write-up is a patch diff, not a report of an incident: the researchers compared ESG 9.4.0.027 against 9.4.0.029 and worked backwards from Barracuda's own fixes.
The first bug is in the password-change path. When a change fails, the pre-patch code returns the current session's role object instead of bailing out, so the request keeps running as the low-privilege login-screen role. Barracuda's installer describes the fix as stopping an "arbitrary Spam_Config restore". The second bug is a command injection: the timezone value gets handed to a shell through a sed call in Backup2.pm and fix_tz.pl, and the patched code checks the value against /usr/share/zoneinfo/ before use. The restore function is the route between them.
Barracuda's advisory scores the bypass 9.3 critical and the injection 8.6 high. watchTowr notes the patch installer carries a 9.8 for the bypass and guesses it covers both bugs together. The injection is listed against ESG, Load Balancer ADC, Message Archiver, WAF Control Center, Web Application Firewall and Web Security Gateway.
If you run ESG, check your version against Barracuda's advisory and patch. We'd treat the gap between 9.3 and 9.8 as a scoring argument, not a mitigation.
CVE references
Sources
If something here is wrong, tell us. Every correction is listed on the corrections page.
Don’t Just Read About Cyberattacks. Learn How They Work.
Go beyond the headlines. Explore hands-on cybersecurity labs, understand real-world vulnerabilities, and build practical security skills with HackZoneLabs.
Start Learning