Barracuda Email Security Gateway flaws could let attackers take full control, researchers warn

Researchers at watchTowr Labs have published analysis of two vulnerabilities in the Barracuda Email Security Gateway (ESG), tracked as CVE-2026-116606 and CVE-2026-111560. The ESG is an appliance that sits at the edge of a network and inspects email, which makes any weakness in it a concern for the organisations that rely on it. Barracuda has documented the issues in its own advisory.

According to the researchers, either flaw on its own is serious, but the combination is worse. They describe the chained issues as a pre-authentication remote root code execution risk, meaning an attacker would not need valid credentials to gain full control of the device. Barracuda's advisory scores one of the issues at 9.3 on the CVSS severity scale. watchTowr notes its own figure of 9.8, which it believes reflects both vulnerabilities being scored together.

To investigate, the team set up appliances and compared two software versions to see what had changed. Barracuda released several patch files for these issues, and watchTowr reviewed two of them. This is only the opening of the research, so the full technical detail is not covered here. Organisations running the ESG should read Barracuda's advisory and confirm that the relevant patches have been applied.