Researchers chain Barracuda flaws for unauthenticated root access

Two flaws in Barracuda’s Email Security Gateway can be chained to give an unauthenticated attacker root access with no login required, according to security researchers and Barracuda’s advisory published on 6 November 2026. The first flaw, CVE-2026-116606, is an authorization bypass that enables an unauthenticated attacker to restore a crafted configuration backup and alter the appliance’s global settings.

The second, CVE-2026-111560, is a command injection vulnerability that would ordinarily require an administrator account to execute commands with root privileges; when chained with the bypass, an attacker can reach root without logging in. The chain was demonstrated by watchTowr in their technical analysis.

As for impact and fixes, the authorization bypass affects only the Email Security Gateway, while the command-injection flaw affects five additional Barracuda products but still requires an administrator account on those. Barracuda has released patches for each affected product, with fixed firmware listed in its security advisory. The Email Security Gateway is patched in version 9.4.0.030 and later. Mandiant assigns high severity scores to both CVEs (9.3/10 for the bypass; 8.6/10 for the injection).

The advisory recommends applying patches or upgrading to the fixed firmware, restricting administration interfaces to trusted internal networks if patching cannot be completed immediately, and re-enabling automatic patching where it has been turned off. watchTowr also released a detection tool to identify vulnerable appliances, though no exploit has been published to date.