Two flaws in Barracuda’s Email Security Gateway, an email-filtering appliance, can be chained to run commands on it as root, its highest level of access, with no login required.
The company released patches on Monday, and the security firm watchTowr detailed the attack chain on Thursday.
One flaw, CVE-2026-116606, is an authorization bypass. An unauthenticated attacker can use it to restore a crafted configuration backup and change the appliance’s global settings.
The other, CVE-2026-111560, is a command injection. It runs commands as root but normally needs an administrator account, and on the Email Security Gateway the bypass gives an attacker that access. Chained, the two let an attacker reach root with no login.
Affected Products and Fixes
The authorization bypass affects only the Email Security Gateway. The command injection reaches five other products, but on those it still needs an administrator account.
Mandiant, which assigned the two CVE records, rates the bypass 9.3 out of 10 and the command injection 8.6. Barracuda has released a patch for each affected product and lists the fixed firmware in its security advisory. The Email Security Gateway is fixed in version 9.4.0.030 and later.
What to Do
The advisory sets out three steps:
- Apply the patch for each affected product, or upgrade to the fixed firmware listed above.
- If you cannot patch at once, limit the appliance’s administration interface to trusted internal networks.
- If you have turned automatic patching off, switch it back on.
How the Chain Works
In its technical analysis, watchTowr traced the chain through the appliance’s code. A failed password change returns the attacker a low-privilege role instead of stopping the request, which leaves a backup-restore function open to someone who has not logged in.
That function accepts an uploaded backup, and the restored data includes a timezone value that the appliance later runs as a shell command with root privileges. Barracuda guards backups with a checksum, but the secret used to compute it is built into the code, allowing an attacker to forge a valid checksum. The firm showed the attack by writing a file to the appliance as root.
As of this week, neither flaw appears in CISA’s Known Exploited Vulnerabilities (KEV catalog), and no public report ties either to an attack. watchTowr also released a detection tool that checks whether an appliance is vulnerable, but has not published an exploit.
The Email Security Gateway was hit in the 2023 attacks by a group tracked as UNC4841, which exploited a different flaw, CVE-2023-2868, as a zero-day. That case is unrelated to the two flaws patched this week, and nothing ties the new pair to any attacker.
