"Two flaws in Barracuda's Email Security Gateway ... can be chained to run commands on it as root, its highest level of access, with no login required."
The two flaws: CVE-2026-116606 and CVE-2026-111560
Researchers detailed a paired vulnerability chain that elevates an attacker to root on Barracuda's Email Security Gateway without any authentication. The first flaw, CVE-2026-116606, is an authorization bypass that lets an unauthenticated actor restore a crafted configuration backup and alter global settings. The second, CVE-2026-111560, is a command injection that can run commands as root but normally requires an administrator account. Chained together, the bypass gives the attacker the administrator-level access the command injection needs, enabling root execution with no login.
Mandiant assigned the two CVE records and rated CVE-2026-116606, the bypass, 9.3 out of 10; it rated CVE-2026-111560, the command injection, 8.6 out of 10.
How watchTowr reconstructed the chain
Security firm watchTowr published a technical analysis tracing the attack path through the appliance's code. Their report says a failed password-change request returns a low-privilege role instead of halting the request, which leaves a backup-restore function accessible to an unauthenticated caller. That restore function accepts an uploaded backup whose contents include a timezone value; the appliance later executes that timezone value as a shell command with root privileges.
Barracuda protects backups using a checksum, but watchTowr found the secret used to compute that checksum is embedded in the product's code, allowing an attacker to forge a valid checksum for a crafted backup file. watchTowr demonstrated the chain by writing a file to the appliance as root.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildAffected products, patches, and Barracuda's advisory
The authorization-bypass flaw affects only the Email Security Gateway. The command-injection flaw reaches five other Barracuda products, though on those other products the bug still requires an administrator account to be exploited. Barracuda released patches for each affected product and published the fixed firmware in a security advisory; the Email Security Gateway is fixed in version 9.4.0.030 and later.
Barracuda's advisory prescribes three immediate actions for operators: apply the patch or upgrade to the listed fixed firmware; if you cannot patch immediately, limit the appliance's administration interface to trusted internal networks; and if automatic patching has been turned off, turn it back on.
Detection, exploitation status, and the record
As of this week, neither flaw appears in CISA's Known Exploited Vulnerabilities (KEV) catalog, and the public record contains no reports tying either vulnerability to an active attack. watchTowr released a detection tool that checks whether an appliance is vulnerable, but the firm has not published a working exploit.
The Email Security Gateway was hit in 2023 by a group tracked as UNC4841, which exploited a different flaw, CVE-2023-2868, as a zero-day. That incident is unrelated to the two flaws patched this week, and watchTowr and Barracuda report no link between the new pair and any attacker.
What this means for technologists, CISA/regulators, and affected enterprises
- Technologists and security teams: The immediately actionable steps match Barracuda's advisory — install the listed firmware (Email Security Gateway 9.4.0.030 or later), restrict administrative interfaces to trusted internal networks if patching is delayed, and re-enable automatic patching if it was disabled. Use watchTowr's detection tool to validate whether appliances are vulnerable.
- CISA, regulators, and incident responders: Neither CVE appears in the KEV catalog yet. That absence, plus the lack of public exploitation reports, suggests monitoring and cataloging remain appropriate near-term actions while operators implement the vendor fixes.
- Affected enterprises and procurement leaders: Because the command-injection bug is present in additional Barracuda products (though exploitable there only with admin access), organizations should inventory deployed Barracuda appliances, confirm firmware versions, and prioritize patching where the Email Security Gateway is in use given the authorization bypass unique to that product.
Barracuda has acted with firmware updates and a clear advisory; watchTowr has provided a technical reconstruction and a detection tool. The record is specific: a coded secret in backups, a backup-restore path reachable without authentication, and a timezone value executed as a shell command can be combined to yield root. For operators running the Email Security Gateway, the concrete imperative is straightforward — follow Barracuda's advisory, apply the 9.4.0.030 update or later, and harden administration access while detection and cataloging continue.
Source: https://thehackernews.com/2026/11/experts-demonstrate-barracuda-email.html
