Barracuda Networks is your new best friend (Barracuda Email Security Gateway Pre-Auth Remote Root RCE CVE

Barracuda ESG solution addresses CVE-2026-116606 (Pre-Authentication Authorization Bypass, CVSS 9.3 Critical) and CVE-2026-111560 (OS Command Injection, CVSS 8.6 High).
CVE-2026-116606 is fixed in version 9.4.0.029; the author tested against vulnerable version 9.4.0.027.
CVE-2026-111560 affects ESG, Load Balancer ADC, Message Archiver, WAF Control Center, Web Application Firewall, and Web Security Gateway.
The vulnerability in CVE-2026-116606 stems from a failure to stop execution when a password change attempt fails with ERROR\PASSWD\CHANGE on Index.pm.
CVE-2026-111560 involves command injection sinks in Backup2.pm and fixtz.pl.
The Command Injection vulnerability in fix\tz.pl executes via sudo, meaning it runs as root.
An exploit path leverages an upload handler (bayesian\upload.pm) which uses user-provided backup files that contain a mysql\dump within a backup.xml file.
The checksum for the backup is calculated using md5(file\bytes + CHECKSUM\SECRET + ".").

This material functions as high-level vulnerability research presented by a security vendor, blending technical deep-dive with product advocacy. The core rhetorical maneuver involves establishing maximum crisis severity—from "not ideal" to "scathing"—before presenting the solution within the author's own ecosystem (watchTowr Labs). The narrative builds tension by showing how two seemingly separate flaws intersect: one an application logic bypass, the other a severe OS execution capability. This fusion allows the demonstration of a complex attack chain originating from an innocuous-seeming feature—a file upload handler accepting a backup archive.
The mechanism itself reveals a common weakness in enterprise software design: security controls layered sequentially (e.g., failed auth $\rightarrow$ continue processing) are often more fragile than monolithic fail-safe designs. Furthermore, the Command Injection vulnerability is elevated not just by its presence but by its elevation to root privileges via `sudo` during essential operational tasks like timezone restoration. The assumption underpinning the threat model—that any low-privilege endpoint can be leveraged into a root execution context—is central here.
Patterns detected: ARC-0024 Ambiguity, ARC-0193 Vendor Advertorial
The ambiguity arises from the intentional downplaying of severity in initial descriptions before the technical walkthrough proves catastrophic potential. The strongest load-bearing pattern is the Vendor Advertorial test: research detailing critical vulnerabilities serves as proof of concept not just for intelligence gathering, but to drive traffic toward proprietary defensive platforms (watchTowr Platform) by framing their service as preemptive necessity rather than optional audit compliance.
The fundamental paradigm driving this narrative is Defensive Scarcity—the idea that security assurance requires an expensive, specialized external entity to validate the internal hygiene of complex systems. Human agency here is threatened less by a malicious actor and more by operational inertia: organizations may view patching two separate vulnerabilities as manageable, failing to recognize the single exploitable pathway created by their combination. What other types of systemic integration failures are we relying on current architecture to obscure? How often does 'completeness' in vendor patches mask fundamental design flaws that transcend any specific CVE ID?
Autonomy check: No autonomy signals.