{
  "id": 18459059,
  "title": "Experts Demonstrate Barracuda Email Security Gateway Chain Enabling Root Access Without Login",
  "url": "https://urgent.news/2026/11/06/experts-demonstrate-barracuda-email-security-gateway-chain-enabling",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-11-06T05:39:10.000Z",
  "source": {
    "name": "The Hacker News",
    "slug": "the-hacker-news",
    "url": "https://thehackernews.com/2026/11/experts-demonstrate-barracuda-email.html"
  },
  "original_language": "en",
  "account": "Two security flaws in Barracuda's Email Security Gateway were recently discovered, both of which allow attackers to gain root access without needing to log in. The company released patches on Monday, with the security firm watchTowr detailing the attack chain on Thursday. One flaw, CVE-2026-116606, is an authorization bypass that lets an unauthenticated attacker restore a crafted configuration backup and modify the appliance's global settings. The other, CVE-2026-111560, is a command injection vulnerability that enables an attacker to run commands as root, but typically requires an administrator account. When combined, these two flaws allow an attacker to gain root access without logging in at all. The authorization bypass specifically affects the Email Security Gateway, while the command injection affects five other products, though it still requires an administrator account on those. Barracuda has released patches for each affected product, with the Email Security Gateway being secured in version 9.4.0.030 and later. The Email Security Gateway was previously targeted in the 2023 attacks by a group known as UNC4841, which exploited a different flaw as a zero-day. Neither of the newly discovered flaws have been reported in CISA's Known Exploited Vulnerabilities (KEV) catalog, and no public reports have linked them to actual attacks. watchTowr has released a detection tool to identify vulnerable appliances, but has not published an exploit.",
  "summary": "Two flaws in Barracuda's Email Security Gateway, an email-filtering appliance, can be chained to run commands on it as root, its highest level of access, with no login required. The company released patches on Monday, and the security firm watchTowr detailed the attack chain on Thursday. One flaw, CVE-2026-116606, is an authorization bypass. An unauthenticated attacker can use it to restore a",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 2,
    "also_reported_by": [
      {
        "outlet": "Lobsters",
        "title": "Barracuda Networks is your new best friend (Barracuda Email Security Gateway Pre-Auth Remote Root RCE CVE-2026-116606 / CVE-2026-111560)",
        "url": "https://urgent.news/2026/11/06/barracuda-networks-is-your-new-best-friend-barracuda-email-security",
        "published": "2026-11-06T07:29:25.000Z"
      }
    ]
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}