Barracuda Networks is your new best friend (Barracuda Email Security Gateway Pre-Auth Remote Root RCE CVE-2026-116606 / CVE-2026-111560)

Barracuda Networks has recently disclosed two vulnerabilities, CVE-2026-116606 and CVE-2026-111560, affecting its Email Security Gateway solution. These vulnerabilities allow an attacker to perform a Pre-Authentication Authorization Bypass and execute arbitrary commands with root privileges through the appliance's upload handler.

The first vulnerability exists in the Backup2.pm file, where an attacker can manipulate input to rewrite the shell grammar, enabling the execution of any command as root. The second vulnerability is found in the fix_tz.pl file, where an attacker can write to the operating system's clock file, also gaining root access. Barracuda has released patch files to address these vulnerabilities, but they are recommended for immediate deployment due to the critical nature of the issues.