Barracuda Email Security Gateway flaws enable root access without login
Original title: Experts Demonstrate Barracuda Email Security Gateway Chain Enabling Root Access Without Login
Two flaws chained allow root command execution without login; patches released for affected products.
Two vulnerabilities in Barracuda Email Security Gateway can be chained to gain root access without login. One is authorization bypass allowing backup restore and config changes. The other is command injection. Patches released for Email Security Gateway 9.4.0.030 and later. The command injection affects five other products.
- CVE-2026-116606 authorization bypass
- CVE-2026-111560 command injection
- Chained attack reaches root
- Fixed in 9.4.0.030
- No known exploitation
- Vendors
- Barracuda
- Products
- Email Security Gateway
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-111560 | Command Injection in Barracuda Appliance Timezone Field | 8.6 | — | ||
| CVE-2026-116606 | Auth bypass in Barracuda Email Security Gateway before 9.4.0.030 | 9.3 | — |
From the original article
2 min read at thehackernews.com
Two flaws in Barracuda's Email Security Gateway, an email-filtering appliance, can be chained to run commands on it as root, its highest level of access, with no login required. The company released patches on Monday, and the security firm watchTowr detailed the attack chain on Thursday. One flaw, CVE-2026-116606, is an authorization bypass.
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.