Experts Demonstrate Barracuda Email Security Gateway Chain Enabling Root Access Without Login

Summary: Two flaws in Barracuda's Email Security Gateway can be chained to run commands as root with no login required: CVE-2026-116606 is an authorization bypass that lets an unauthenticated attacker restore a crafted configuration backup and change global settings, and CVE-2026-111560 is a command injection that runs commands as root but normally needs an administrator account. Barracuda released patches on Monday, with the Email Security Gateway fixed in version 9.4.0.030 and later, and Mandiant rates the bypass 9.3 out of 10 and the command injection 8.6.
Bottom line: watchTowr traced the chain to a failed password change that returns a low-privilege role instead of stopping the request, and a backup checksum secret built into the code that lets an attacker forge a valid checksum - so root access on an internet-facing email appliance needs no credentials at all. Neither flaw is in CISA's KEV catalog and no public report ties either to an attack, but this is the same appliance a group tracked as UNC4841 hit in 2023 using CVE-2023-2868 as a zero-day.

Read the original at The Hacker News ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2023-2868 CVE-2026-111560 CVE-2026-116606
Related: CISA Adds Six Known Exploited Vulnerabilities to Catalog Cyber Risks · Nov 10, 2026
Barracuda Flaws Could Be Chained to Bypass Authorization and Gain Root Access Cyber Risks ·
CVE-2026-116606: Barracuda Networks Email Security Gateway (ESG) Authentication Bypass Using an Alternate Path or Channel Vulnerability Known Exploited Vulnerabilities · Nov 10, 2026