Experts Demonstrate Barracuda Email Security Gateway Chain Enabling Root Access Without Login

Two security flaws in Barracuda's Email Security Gateway were recently discovered, both of which allow attackers to gain root access without needing to log in. The company released patches on Monday, with the security firm watchTowr detailing the attack chain on Thursday. One flaw, CVE-2026-116606, is an authorization bypass that lets an unauthenticated attacker restore a crafted configuration backup and modify the appliance's global settings.

The other, CVE-2026-111560, is a command injection vulnerability that enables an attacker to run commands as root, but typically requires an administrator account. When combined, these two flaws allow an attacker to gain root access without logging in at all. The authorization bypass specifically affects the Email Security Gateway, while the command injection affects five other products, though it still requires an administrator account on those.

Barracuda has released patches for each affected product, with the Email Security Gateway being secured in version 9.4.0.030 and later. The Email Security Gateway was previously targeted in the 2023 attacks by a group known as UNC4841, which exploited a different flaw as a zero-day. Neither of the newly discovered flaws have been reported in CISA's Known Exploited Vulnerabilities (KEV) catalog, and no public reports have linked them to actual attacks. watchTowr has released a detection tool to identify vulnerable appliances, but has not published an exploit.