Barracuda Networks is your new best friend (Barracuda Email Security Gateway Pre-Auth Remote Root RCE CVE-2026-116606 / CVE-2026-111560)
Yes, that's right! Today we're at the aquarium. Welcome back to yet another watchTowr Labs blog post. You can begin preparing your comments now. What Is A Barracuda, And Why? Must We? Barracuda’s Email Security Gateway solution (ESG) is no stranger to love , for
Summary from watchTowr Labs.
Explained
The technology and terms in this story. Learn more
Why it was possible
The weaknesses behind this story's CVEs, from each CVE Record.
- CWE-288Authentication Bypass Using an Alternate Path or ChannelA second route (a debug port, an API) reaches the protected function without the login check.
- CWE-78Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')Input reaches an operating-system shell, letting an attacker run any command the service can.
Vulnerabilities in this story
Severity and exploitation facts from NVD, FIRST, and CISA.
Related coverage
Other sources covering the same vulnerabilities or event.
SANS Stormcast Tuesday, November 3rd, 2026: Multipath TCP (MPTCP) Detection; BTCPay Server 2.4.1 Hot Wallet Thefts; Barracuda ESG Flaws (CVE-2026-116606, CVE-2026-111560); Synology DSM Ransomware
Podcast6 minSANS Internet Storm Center StormCast3d agoVulnerabilitiesEndpointCVE-2026-111560CVE-2026-116606+1