{
  "id": 18463441,
  "title": "Barracuda Networks is your new best friend (Barracuda Email Security Gateway Pre-Auth Remote Root RCE CVE-2026-116606 / CVE-2026-111560)",
  "url": "https://urgent.news/2026/11/06/barracuda-networks-is-your-new-best-friend-barracuda-email-security",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-11-06T07:29:25.000Z",
  "source": {
    "name": "Lobsters",
    "slug": "lobsters",
    "url": "https://labs.watchtowr.com/barracuda-networks-is-your-new-best-friend-barracuda-email-security-gateway-pre-auth-remote-root-rce-cve-2026-116606-cve-2026-111560/"
  },
  "original_language": "en",
  "account": "Barracuda Networks has recently disclosed two vulnerabilities, CVE-2026-116606 and CVE-2026-111560, affecting its Email Security Gateway solution. These vulnerabilities allow an attacker to perform a Pre-Authentication Authorization Bypass and execute arbitrary commands with root privileges through the appliance's upload handler. The first vulnerability exists in the Backup2.pm file, where an attacker can manipulate input to rewrite the shell grammar, enabling the execution of any command as root. The second vulnerability is found in the fix_tz.pl file, where an attacker can write to the operating system's clock file, also gaining root access. Barracuda has released patch files to address these vulnerabilities, but they are recommended for immediate deployment due to the critical nature of the issues.",
  "summary": null,
  "key_points": [
    "Two critical vulnerabilities discovered in Barracuda Email Security Gateway.",
    "Pre-auth remote code execution (RCE) and privilege escalation possible.",
    "Patches released, deployment recommended immediately."
  ],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 2,
    "also_reported_by": [
      {
        "outlet": "The Hacker News",
        "title": "Experts Demonstrate Barracuda Email Security Gateway Chain Enabling Root Access Without Login",
        "url": "https://urgent.news/2026/11/06/experts-demonstrate-barracuda-email-security-gateway-chain-enabling",
        "published": "2026-11-06T05:39:10.000Z"
      }
    ]
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}