Barracuda Email Security Gateway Vulnerabilities Enable Unauthenticated Root Access
Two chained flaws allow attackers to bypass authentication and execute commands as root.
1Critical Authentication Bypass
Two distinct vulnerabilities in Barracuda's Email Security Gateway allow unauthenticated attackers to gain root access. The first flaw, CVE-2026-116606, functions as an authorization bypass. By exploiting this, unauthorized users can restore crafted configuration backups. This process effectively overrides global appliance settings without requiring any valid administrative login credentials.
2Command Injection Mechanism
The second vulnerability, CVE-2026-111560, is a command injection flaw. While this typically requires administrative privileges, the authorization bypass grants the necessary access level. When chained together, these vulnerabilities allow an attacker to execute arbitrary commands with root privileges, which represents the highest level of system control available.
3Technical Attack Chain
Analysis by watchTowr reveals that a failed password change incorrectly grants low-privilege roles instead of blocking requests. This exposes a backup-restore function to unauthenticated users. Although Barracuda protects backups with checksums, the secret key is hardcoded within the firmware, enabling attackers to forge valid checksums and bypass security integrity checks.
4Severity and Impact
Mandiant assigned high severity scores to these flaws, rating the authorization bypass at 9.3 and the command injection at 8.6 out of 10. While the bypass affects only the Email Security Gateway, the command injection vulnerability impacts five additional Barracuda products, though those require administrator accounts for successful exploitation.
5Patching and Remediation
Barracuda released security patches this Monday to address both vulnerabilities across affected products. For the Email Security Gateway, users must update to firmware version 9.4.0.030 or later to mitigate these risks. The company has published a detailed security advisory listing all specific firmware versions that contain the necessary fixes.
6Current Threat Landscape
As of this week, neither vulnerability appears in the CISA Known Exploited Vulnerabilities catalog. There are currently no public reports linking these specific flaws to active exploitation attempts. While watchTowr released a detection tool to help administrators identify vulnerable appliances, they have not published a functional exploit for these issues.
7Historical Context
This incident follows a 2023 security event where the group UNC4841 exploited a different zero-day vulnerability, CVE-2023-2868, within the same Email Security Gateway product. However, current technical analysis confirms that the newly discovered flaws are entirely unrelated to that previous campaign and no evidence suggests a connection to any specific threat actor.
8Security Recommendations
Organizations utilizing Barracuda appliances should prioritize firmware updates immediately to close these identity and access gaps. Security teams should utilize the provided detection tools to verify their current exposure levels. Maintaining visibility across machine identities and monitoring for unauthorized configuration changes remains essential for defending against these types of appliance-level vulnerabilities.